Edit tour

Linux Analysis Report
gnjqwpc.elf

Overview

General Information

Sample name:	gnjqwpc.elf
Analysis ID:	1581711
MD5:	12de90cdff8b135be46e841670cbb9e7
SHA1:	c344554da1746c30541cb75f66bbbc95df227415
SHA256:	52d58da3e7dff8f35da1ae6b89bb9a58072a8e6dd3e66161e4ba49dfb2032e30
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581711
Start date and time:	2024-12-28 19:21:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gnjqwpc.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/156@22/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/gnjqwpc.elf
PID:	6241
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

gnjqwpc.elf (PID: 6241, Parent: 6164, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/gnjqwpc.elf

gnjqwpc.elf New Fork (PID: 6243, Parent: 6241)

gnjqwpc.elf New Fork (PID: 6245, Parent: 6243)

gnjqwpc.elf New Fork (PID: 6405, Parent: 6245)

sh (PID: 6405, Parent: 6245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6411, Parent: 6405)

ps (PID: 6411, Parent: 6405, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnjqwpc.elf New Fork (PID: 6917, Parent: 6245)

sh (PID: 6917, Parent: 6245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6919, Parent: 6917)

ps (PID: 6919, Parent: 6917, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6247, Parent: 1477)

sh (PID: 6247, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6247, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6252, Parent: 1)

systemd-hostnamed (PID: 6252, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6401, Parent: 1320)

Default (PID: 6401, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6402, Parent: 1320)

Default (PID: 6402, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6472, Parent: 1)

journalctl (PID: 6472, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6488, Parent: 1)

systemd-journald (PID: 6488, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6492, Parent: 1)

journalctl (PID: 6492, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6508, Parent: 1)

dbus-daemon (PID: 6508, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6510, Parent: 1860)

pulseaudio (PID: 6510, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6512, Parent: 1)

rsyslogd (PID: 6512, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6516, Parent: 1)

systemd-logind (PID: 6516, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6529, Parent: 1)

rtkit-daemon (PID: 6529, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6584, Parent: 1)

polkitd (PID: 6584, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6589, Parent: 1)

agetty (PID: 6589, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6590, Parent: 1320)

Default (PID: 6590, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6591, Parent: 1)

gpu-manager (PID: 6591, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6592, Parent: 6591)

sh (PID: 6592, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6594, Parent: 6591)

sh (PID: 6594, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6595, Parent: 6594)

grep (PID: 6595, Parent: 6594, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6596, Parent: 6591)

sh (PID: 6596, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6597, Parent: 6596)

grep (PID: 6597, Parent: 6596, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6599, Parent: 6591)

sh (PID: 6599, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6600, Parent: 6599)

grep (PID: 6600, Parent: 6599, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6601, Parent: 6591)

sh (PID: 6601, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6602, Parent: 6601)

grep (PID: 6602, Parent: 6601, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6605, Parent: 6591)

sh (PID: 6605, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6606, Parent: 6605)

grep (PID: 6606, Parent: 6605, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6610, Parent: 6591)

sh (PID: 6610, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6611, Parent: 6610)

grep (PID: 6611, Parent: 6610, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6612, Parent: 6591)

sh (PID: 6612, Parent: 6591, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6613, Parent: 6612)

grep (PID: 6613, Parent: 6612, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6603, Parent: 2038)

fusermount (PID: 6603, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6616, Parent: 1)

generate-config (PID: 6616, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6617, Parent: 6616)

pkill (PID: 6617, Parent: 6616, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6618, Parent: 1)

gdm-wait-for-drm (PID: 6618, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6624, Parent: 1)

gdm3 (PID: 6624, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6627, Parent: 6624)

plymouth (PID: 6627, Parent: 6624, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6637, Parent: 6624)

gdm-session-worker (PID: 6637, Parent: 6624, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6641, Parent: 6637)

gdm-wayland-session (PID: 6641, Parent: 6637, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6643, Parent: 6641)

dbus-daemon (PID: 6643, Parent: 6641, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6645, Parent: 6643)

dbus-daemon New Fork (PID: 6646, Parent: 6645)

false (PID: 6646, Parent: 6645, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6647, Parent: 6641)

dbus-run-session (PID: 6647, Parent: 6641, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6650, Parent: 6647)

dbus-daemon (PID: 6650, Parent: 6647, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6651, Parent: 6624)

Default (PID: 6651, Parent: 6624, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6652, Parent: 6624)

Default (PID: 6652, Parent: 6624, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6628, Parent: 1)

accounts-daemon (PID: 6628, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6632, Parent: 6628)

language-validate (PID: 6632, Parent: 6628, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6633, Parent: 6632)

language-options (PID: 6633, Parent: 6632, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6634, Parent: 6633)

sh (PID: 6634, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6635, Parent: 6634)

locale (PID: 6635, Parent: 6634, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6636, Parent: 6634)

grep (PID: 6636, Parent: 6634, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6654, Parent: 1)

agetty (PID: 6654, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6655, Parent: 1)

rsyslogd (PID: 6655, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6657, Parent: 1)

dbus-daemon (PID: 6657, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6663, Parent: 1)

gpu-manager (PID: 6663, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6664, Parent: 6663)

sh (PID: 6664, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6665, Parent: 6664)

grep (PID: 6665, Parent: 6664, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6666, Parent: 6663)

sh (PID: 6666, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6667, Parent: 6666)

grep (PID: 6667, Parent: 6666, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6728, Parent: 6663)

sh (PID: 6728, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6730, Parent: 6728)

grep (PID: 6730, Parent: 6728, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6732, Parent: 6663)

sh (PID: 6732, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6733, Parent: 6732)

grep (PID: 6733, Parent: 6732, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6734, Parent: 6663)

sh (PID: 6734, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6735, Parent: 6734)

grep (PID: 6735, Parent: 6734, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6736, Parent: 6663)

sh (PID: 6736, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6737, Parent: 6736)

grep (PID: 6737, Parent: 6736, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6738, Parent: 6663)

sh (PID: 6738, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6739, Parent: 6738)

grep (PID: 6739, Parent: 6738, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6740, Parent: 6663)

sh (PID: 6740, Parent: 6663, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6741, Parent: 6740)

grep (PID: 6741, Parent: 6740, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6671, Parent: 1)

systemd-logind (PID: 6671, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6742, Parent: 1)

generate-config (PID: 6742, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6743, Parent: 6742)

pkill (PID: 6743, Parent: 6742, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6746, Parent: 1)

gdm-wait-for-drm (PID: 6746, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6750, Parent: 1)

rsyslogd (PID: 6750, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6751, Parent: 1)

dbus-daemon (PID: 6751, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6757, Parent: 1)

rsyslogd (PID: 6757, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6758, Parent: 1)

dbus-daemon (PID: 6758, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6766, Parent: 1)

systemd-logind (PID: 6766, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6825, Parent: 1)

journalctl (PID: 6825, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6826, Parent: 1)

systemd-journald (PID: 6826, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6829, Parent: 1)

rsyslogd (PID: 6829, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6830, Parent: 1)

dbus-daemon (PID: 6830, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6833, Parent: 1)

systemd-logind (PID: 6833, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6890, Parent: 1)

systemd-journald (PID: 6890, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6895, Parent: 1)

agetty (PID: 6895, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6896, Parent: 1)

gpu-manager (PID: 6896, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6897, Parent: 6896)

sh (PID: 6897, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6897)

grep (PID: 6898, Parent: 6897, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6900, Parent: 6896)

sh (PID: 6900, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6901, Parent: 6900)

grep (PID: 6901, Parent: 6900, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6903, Parent: 6896)

sh (PID: 6903, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6904, Parent: 6903)

grep (PID: 6904, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6905, Parent: 6896)

sh (PID: 6905, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6906, Parent: 6905)

grep (PID: 6906, Parent: 6905, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6907, Parent: 6896)

sh (PID: 6907, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6908, Parent: 6907)

grep (PID: 6908, Parent: 6907, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6909, Parent: 6896)

sh (PID: 6909, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6911, Parent: 6909)

grep (PID: 6911, Parent: 6909, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6915, Parent: 6896)

sh (PID: 6915, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6916, Parent: 6915)

grep (PID: 6916, Parent: 6915, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6921, Parent: 6896)

sh (PID: 6921, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6922, Parent: 6921)

grep (PID: 6922, Parent: 6921, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6923, Parent: 1)

generate-config (PID: 6923, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6924, Parent: 6923)

pkill (PID: 6924, Parent: 6923, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6927, Parent: 1)

gdm-wait-for-drm (PID: 6927, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6932, Parent: 1)

gdm3 (PID: 6932, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6935, Parent: 6932)

plymouth (PID: 6935, Parent: 6932, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6949, Parent: 6932)

gdm-session-worker (PID: 6949, Parent: 6932, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6953, Parent: 6949)

gdm-wayland-session (PID: 6953, Parent: 6949, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6955, Parent: 6953)

dbus-daemon (PID: 6955, Parent: 6953, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6957, Parent: 6955)

dbus-daemon New Fork (PID: 6958, Parent: 6957)

false (PID: 6958, Parent: 6957, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6959, Parent: 6953)

dbus-run-session (PID: 6959, Parent: 6953, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6960, Parent: 6959)

dbus-daemon (PID: 6960, Parent: 6959, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6963, Parent: 6932)

Default (PID: 6963, Parent: 6932, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6964, Parent: 6932)

Default (PID: 6964, Parent: 6932, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6936, Parent: 1)

accounts-daemon (PID: 6936, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6940, Parent: 6936)

language-validate (PID: 6940, Parent: 6936, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6941, Parent: 6940)

language-options (PID: 6941, Parent: 6940, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6942, Parent: 6941)

sh (PID: 6942, Parent: 6941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6943, Parent: 6942)

locale (PID: 6943, Parent: 6942, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6944, Parent: 6942)

grep (PID: 6944, Parent: 6942, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6945, Parent: 1)

polkitd (PID: 6945, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6977, Parent: 1)

systemd-journald (PID: 6977, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6978, Parent: 1)

dbus-daemon (PID: 6978, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6981, Parent: 1)

agetty (PID: 6981, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6982, Parent: 1)

systemd-logind (PID: 6982, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6999, Parent: 1)

dbus-daemon (PID: 6999, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7004, Parent: 1860)

dbus-daemon (PID: 7004, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7005, Parent: 1)

rsyslogd (PID: 7005, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7044, Parent: 1860)

pulseaudio (PID: 7044, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7051, Parent: 1)

gpu-manager (PID: 7051, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7052, Parent: 7051)

sh (PID: 7052, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7053, Parent: 7052)

grep (PID: 7053, Parent: 7052, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7054, Parent: 7051)

sh (PID: 7054, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7055, Parent: 7054)

grep (PID: 7055, Parent: 7054, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7056, Parent: 7051)

sh (PID: 7056, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7057, Parent: 7056)

grep (PID: 7057, Parent: 7056, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7061, Parent: 7051)

sh (PID: 7061, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7062, Parent: 7061)

grep (PID: 7062, Parent: 7061, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7067, Parent: 7051)

sh (PID: 7067, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7071, Parent: 7067)

grep (PID: 7071, Parent: 7067, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7072, Parent: 7051)

sh (PID: 7072, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7073, Parent: 7072)

grep (PID: 7073, Parent: 7072, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7074, Parent: 7051)

sh (PID: 7074, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7075, Parent: 7074)

grep (PID: 7075, Parent: 7074, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7076, Parent: 7051)

sh (PID: 7076, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7077, Parent: 7076)

grep (PID: 7077, Parent: 7076, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7059, Parent: 1)

rtkit-daemon (PID: 7059, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7065, Parent: 1)

polkitd (PID: 7065, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7080, Parent: 1)

generate-config (PID: 7080, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7081, Parent: 7080)

pkill (PID: 7081, Parent: 7080, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7084, Parent: 1)

gdm-wait-for-drm (PID: 7084, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7091, Parent: 1)

gdm3 (PID: 7091, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7094, Parent: 7091)

plymouth (PID: 7094, Parent: 7091, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7104, Parent: 7091)

gdm-session-worker (PID: 7104, Parent: 7091, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7110, Parent: 7104)

gdm-wayland-session (PID: 7110, Parent: 7104, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7112, Parent: 7110)

dbus-daemon (PID: 7112, Parent: 7110, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7116, Parent: 7112)

dbus-daemon New Fork (PID: 7117, Parent: 7116)

false (PID: 7117, Parent: 7116, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7118, Parent: 7110)

dbus-run-session (PID: 7118, Parent: 7110, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7119, Parent: 7118)

dbus-daemon (PID: 7119, Parent: 7118, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7123, Parent: 7091)

Default (PID: 7123, Parent: 7091, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7124, Parent: 7091)

Default (PID: 7124, Parent: 7091, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7095, Parent: 1)

accounts-daemon (PID: 7095, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7099, Parent: 7095)

language-validate (PID: 7099, Parent: 7095, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7100, Parent: 7099)

language-options (PID: 7100, Parent: 7099, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7101, Parent: 7100)

sh (PID: 7101, Parent: 7100, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7102, Parent: 7101)

locale (PID: 7102, Parent: 7101, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7103, Parent: 7101)

grep (PID: 7103, Parent: 7101, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7108, Parent: 1)

systemd (PID: 7108, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7113, Parent: 7108)

systemd New Fork (PID: 7114, Parent: 7113)

30-systemd-environment-d-generator (PID: 7114, Parent: 7113, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7125, Parent: 7108)

systemctl (PID: 7125, Parent: 7108, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7126, Parent: 7108)

pulseaudio (PID: 7126, Parent: 7108, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7131, Parent: 7108)

dbus-daemon (PID: 7131, Parent: 7108, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gnjqwpc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
gnjqwpc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fde0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fcc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fde0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: gnjqwpc.elf PID: 6241	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: gnjqwpc.elf PID: 6241	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9046:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x905a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x906e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9082:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9096:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x910e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9122:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9136:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x914a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x915e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9172:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9186:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x919a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6512)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6655)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6750)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6757)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6829)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7005)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6488)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6624)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6643)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6826)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6890)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6932)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6955)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6977)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7091)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7112)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7119)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7108)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr, syslog.200.dr, syslog.182.dr, syslog.132.dr, syslog.295.dr, syslog.188.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38344
Source: unknown	Network traffic detected: HTTP traffic on port 38344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: gnjqwpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: gnjqwpc.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4532, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6268, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6269, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6271, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6403, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6405, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6508, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6512, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6749, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6830, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6899, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6917, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6919, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6932, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6978, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6998, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 4532, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6268, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6269, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6271, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6403, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6405, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6508, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6512, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6749, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6830, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6899, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6917, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6919, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6932, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6978, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6245)	SIGKILL sent: pid: 6998, result: successful	Jump to behavior

Source: gnjqwpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: gnjqwpc.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/156@22/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6508)	File: /proc/6508/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6603)	File: /proc/6603/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6643)	File: /proc/6643/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6650)	File: /proc/6650/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6657)	File: /proc/6657/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6751)	File: /proc/6751/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6758)	File: /proc/6758/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6830)	File: /proc/6830/mounts
Source: /usr/bin/dbus-daemon (PID: 6955)	File: /proc/6955/mounts
Source: /usr/bin/dbus-daemon (PID: 6960)	File: /proc/6960/mounts
Source: /usr/bin/dbus-daemon (PID: 6999)	File: /proc/6999/mounts
Source: /usr/bin/dbus-daemon (PID: 7004)	File: /proc/7004/mounts
Source: /usr/bin/dbus-daemon (PID: 7112)	File: /proc/7112/mounts
Source: /usr/bin/dbus-daemon (PID: 7119)	File: /proc/7119/mounts
Source: /usr/bin/dbus-daemon (PID: 7131)	File: /proc/7131/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6247)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6247)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6252)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76831oqbwLL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76833Hby6yM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:761392Ts15M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76146u0H0uP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76154z10NCO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76239jqxXIL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76247kd2PYM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76373OcJKSO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76418naHIVO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76466Uv2NGN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76523qONdgM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:765267P4tJL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76612lCIotP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76624e5dRAM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:766432cTPFN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:766444yqsML	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76663npGJsL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76664Wc2etM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76731v1nNkN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78953C6WHuM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78961Jyw3wL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:789809hzgkM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79136Zm9B2K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:786762fvBaO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78760anNaTN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79182X4Pj3L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79194zUnzmP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79316Call5O	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79401OGbiXN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/seats/.#seat0Rlk2dW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#1279iMFfU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#1278xEVdU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/seats/.#seat0wP1j9T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127PmM2cS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127MniZ2T	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6584)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6641)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6671)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6671)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6671)	File: /run/systemd/seats/.#seat0rW2wFC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6833)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6833)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/seats/.#seat0FvU2xR
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/users/.#1270PVF6Q
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/users/.#127bWCbiQ
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/seats/.#seat0QUGQwU
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/users/.#1276KSsfT
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/users/.#127ZTSwkR
Source: /lib/systemd/systemd-logind (PID: 6833)	File: /run/systemd/users/.#127eJDd0T
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79796JUyxgd
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79804v7SU8a
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79805oDQLHc
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79818gOEDFd
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79819Uum0Ec
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79820k6KHgc
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79829mApF2a
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:79836IrIhYd
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:798419toY5d
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:81185wdwnX9
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:81200v8cswa
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:81229VuFJVc
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:8123027H5J9
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:81262LV3Okc
Source: /lib/systemd/systemd-journald (PID: 6890)	File: /run/systemd/journal/streams/.#9:812633VQeFa
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6953)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6945)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596789B97BzL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596790L4uKTL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596791Ckq6FL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596797sAV8CM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596807dOf7fM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:596814KsvNzK
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:1027263XncdzM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:1027264IGgliL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:1027265mAZPtN
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:1027274pv1hSM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:1027275Y5270K
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:10655806rWAPN
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:23593407qZQrL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359403jMSEAL
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359405HFXhtJ
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359548vvPsfN
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359561S9LjgM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359563dfKLPN
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359746WHpFpJ
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359795ymW0AM
Source: /lib/systemd/systemd-journald (PID: 6977)	File: /run/systemd/journal/streams/.#9:2359937bCX9sM
Source: /lib/systemd/systemd-logind (PID: 6982)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6982)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/seats/.#seat0JJ6mMa
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127LG50T8
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127YFx7W9
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/seats/.#seat0BQmkrb
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#12775EjC7
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#1278ileJ8
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#1277qZeI7
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127qzsoO8
Source: /usr/lib/policykit-1/polkitd (PID: 7065)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7110)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7095)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7095)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7114)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6890/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6830/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6829/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/environ
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/sched
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6828/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6949/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/1334/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/6953/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 6890)	File opened: /proc/658/cgroup

Source: /tmp/gnjqwpc.elf (PID: 6405)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6917)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6594)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6596)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6599)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6601)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6605)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6610)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6634)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6664)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6666)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6728)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6732)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6734)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6736)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6738)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6740)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6897)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6900)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6905)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6907)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6909)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6915)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6921)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6942)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7052)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7054)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7056)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7061)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7067)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7072)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7074)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7076)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7101)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6595)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6597)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6600)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6602)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6606)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6611)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6613)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6636)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6665)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6667)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6730)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6733)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6735)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6737)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6739)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6741)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6901)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6904)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6906)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6908)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6911)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6916)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6922)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6944)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7053)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7055)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7057)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7062)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7071)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7073)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7075)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7077)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7103)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6617)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6743)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6924)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7081)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6411)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6919)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7125)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6411)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6919)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6826)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6890)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6977)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6589)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6654)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6895)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6981)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6624)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6624)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6932)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6932)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7091)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7091)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7095)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7095)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6512)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6512)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6591)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6655)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6655)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6663)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6750)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6757)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6829)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6829)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6896)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7005)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7005)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7051)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/gnjqwpc.elf (PID: 6243)

File: /tmp/gnjqwpc.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6591)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6663)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6896)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7051)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6411)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6919)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6510)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6617)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6743)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6924)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7044)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7081)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7126)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/gnjqwpc.elf (PID: 6241)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6252)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6510)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6512)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6589)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6591)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6637)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6654)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6655)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6663)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6750)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6757)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6826)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6829)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6890)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6895)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6896)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6949)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6977)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6981)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7005)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7044)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7051)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7104)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7126)	Queries kernel information via 'uname':

Source: syslog.295.dr	Binary or memory string: Dec 28 12:24:42 galassia kernel: [ 587.640149] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.pbAIE8
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: 0kbx86_64/usr/bin/qemu-ppc/tmp/gnjqwpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gnjqwpc.elf
Source: gnjqwpc.elf, 6241.1.000055c812f91000.000055c813041000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.pbAIE8\
Source: gnjqwpc.elf, 6241.1.000055c812f91000.000055c813041000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: syslog.295.dr	Binary or memory string: Dec 28 12:24:42 galassia kernel: [ 587.640128] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: gnjqwpc.elf, 6241.1.00007ffc21dee000.00007ffc21e0f000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7095)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: gnjqwpc.elf, type: SAMPLE
Source: Yara match	File source: 6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gnjqwpc.elf PID: 6241, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: gnjqwpc.elf, type: SAMPLE
Source: Yara match	File source: 6241.1.00007ff4ec001000.00007ff4ec024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gnjqwpc.elf PID: 6241, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gnjqwpc.elf	57%	Virustotal		Browse
gnjqwpc.elf	58%	ReversingLabs	Linux.Trojan.Mirai
gnjqwpc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
raw.cardiacpure.ru	178.215.238.153	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.41.dr, syslog.200.dr, syslog.182.dr, syslog.132.dr, syslog.295.dr, syslog.188.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
raw.cardiacpure.ru	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.215.238.69
	kitsune.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
CANONICAL-ASGB	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	nshkarm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	nshkmips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	wlw68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	nshkmips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wlw68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	woega6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6646/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6958/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7117/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcUv:mcUv
MD5:	0BBD318DB9FA76653482084694D40297
SHA1:	104F7769C891E63003D2F94E1EF3B470A6C571A6
SHA-256:	DA7AD5C826751100FC009C6FE986A597805FCE6D19989C1C213D926580ED79F5
SHA-512:	F181CC64E5206C260EC0AE7ECE8584B00F0A425A6B5BFEEFF86C638455F9F844B5B8517FC1A087C1AD811E9E677FD3AF5DFCC57AFBC49E1C455F4AC648C11659
Malicious:	false
Preview:	7091.

/run/systemd/journal/streams/.#9:1027263XncdzM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.44082348374098
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo6QBj7VBERICjsjOA:SbFuFyLVIg1BG+f+Mo6y7VB4rjNE
MD5:	6FA353FC84FAFD9D3AFD6FA82E488E12
SHA1:	ED537A6BE0336A67F10A84F61D77DDDE2230481A
SHA-256:	F453DA0BDC1B098F3A1C7CD17DDA0D3F6E6BE4633740AAA799464856FBF57BD1
SHA-512:	1060184883A0C28AFE71FD8FE6068DD00335119D0F62B159D2E942B99B8B359BC1692D542879B18F4E99FA1FB73717B3AC0D8001B363F5B82AD20AAF81508BA0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b33fc92c7c524ba7b372a6430da46a15.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:1027264IGgliL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.392718694483872
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmonRXFBxAE8U0TjshP:SbFuFyLVIg1BG+f+MonR/xhv0TjbVC
MD5:	119D4FD383EFF3ED262920305DE4A2A1
SHA1:	2E2305F2DED47E737CFFD853C2822F366C4ADDB7
SHA-256:	10F50604429EECFCF63C0CCA7E85570FC9D8BE12C6A3635862407562C025B330
SHA-512:	2F0008C91B60AE9E092C91CEBD81F9400875E7E29C8DBEE37061B7D5FA8FA8B89D7C129D0C0C3DAF449A020D8C2C4C2DD701248A28499D4725FA717D293DA1AA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b705428b538b4ea0aed567bea26a180f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:1027265mAZPtN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4321433814195705
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4AHFSsWWP0hglsjsV:SbFuFyLVIg1BG+f+M47smhTjLkGq
MD5:	CEB4114942DF9AF1BB61CC36A02D5D8F
SHA1:	165D1E559593795626E354CFF6FCBA7DF0BC25A4
SHA-256:	6C1210DFE1F443BD140EEB642F565A03418862ED9C6A1934AE6BCA9B3ACAB1E9
SHA-512:	7D3B9927D39521E89E847784D13EBD84C6AD3FC5765AE8AF8823C2A8DE0D7CA1245232C337ED2B060E511D5AF3CAFA4F5B9F72724D1F9A0DAB806D3380A3B00D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=276a17cb82784c869372f3f433951eca.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:1027274pv1hSM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.46716576950172
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4VQGBh3S+5Qoswsjs2o:SbFuFyLVIg1BAf+M4KWhi+AZjNALyAZD
MD5:	4C0FF030DD57EB20C96638F8129FCA1A
SHA1:	9414AEDAAFBFB26C17C6CEC487FDC61682CD8A56
SHA-256:	2870BF5040DA5359BCCC5A4C4C8F2BCA51019F7376E57EC4856178E57AE5882F
SHA-512:	8FD55C936D3AEF2D47A302E0831ED89FD29EFE0E471448E27B6EA8E9E7FFCFABCAD50FAF35D683A9BAB8F2CA5398B2B30B6C101302B0E48D17D1CB0D27215E68
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26dbfd7cd084447799fbeb64e82f1a53.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1027275Y5270K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.447919847466921
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8y5WdWftFRURAvF2jsd:SbFuFyLVIg1BAf+M8y5tqmN2jNdQIeXD
MD5:	484ED067F4BCDF8CD2CA9773AB2B5274
SHA1:	79D8DD9AC86F2372A526115B987DC8EF87D06A21
SHA-256:	038CA6278BAA961B84E96EEA14885E91B7B9BCA71E9D9ED8DD9FE094C09F032E
SHA-512:	7FBCCD92065F0FB47C8D99CA67BED4539B5FD63ABD1316DA62C373DC2B9E39A6CFC7A083E2EE955F30A489BE4758DB63FB33754A99132CD0B808EAA288BAD923
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68dc893c68ed42708391e1aa555a5d4e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:10655806rWAPN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.395973911613083
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm42X2idCGROw8js2BZZD:SbFuFyLVIg1BAf+M42ldrRijNTZD
MD5:	131ED3B523A128CFA9C7BA5B179538FA
SHA1:	8D3E524B7799B87845429B165FA46B9F97F3B2A1
SHA-256:	E74052D6CF6339773A79179F873E7F81401E245F45A0FFA9746C1A030B806FB9
SHA-512:	CA1B51ABF3B926B79920CB1234E4E34D187395D88DDBB6D861F231C391ECBCDB78E210D1FEB58BE51E19BA7AC9A83FE3D047A3829B19C4E9DD67437CC744A32C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=250fd17624574d83bb443d864eaa6a46.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:23593407qZQrL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4152833345842595
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+jeABcKRqjLTTIWTIL:qgFq6g10+f+MGWKsEWEL
MD5:	20B62A04B4DD0A2449B00519EA9E06FC
SHA1:	35EDC8C87A09DB41E783FC602FA13993F73627E1
SHA-256:	62BAB4E5889317D2E2BD58742F71FD74035D9C307F722F82301CC15FDDE92F82
SHA-512:	2C1B16F1004008332FF373192F97BFC6A5AAF358F2BA90531DBD98257786B66134C6A3D12749A28582ACAAE73549F64BDB0BD3BD01FE34596FAE62FF9AD5F4F0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4af12b67ab0e4aafbe42ef5c52fc3925.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:2359403jMSEAL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.400588675660322
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzGiBJGe1Zjs2BD0:SbFuFyLVK6g7/+BG+f+MBBxvjNq
MD5:	DD6B03197BCFAE53C1F639A4AE989346
SHA1:	B5DF86C22ACDFF39AA994E3418149B6494286B32
SHA-256:	67DCA9A1444950E2C23CF4FE56ECA3DE3A3077DEEB94D887E30C9E0B333688C9
SHA-512:	474553020AC29D2FE63D3CE8BBB444E85B2D5A8B243A7E41DB7431D77034EAB6F78B7FCC7EA8D96CAEB54A829893ADF3C5B5962E36CDE79EC6CB8394261F7152
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f4c90649cd04dd6a63b2b10bdba8476.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2359405HFXhtJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.462853852327381
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm70L6HfDjGDpnGFF:SbFuFyLVI6g7/+BG+f+M5fcpn6rqjNq
MD5:	0A8289EBBFF5E7CD3B6E4CB1A2AF35BB
SHA1:	D2D8F00CBFF5ED360012DE13A41E5AA1534D3D26
SHA-256:	525711446CFBEBD041F46C634C495DD55F01F8B68EB1B44C5F2DA66618E8E43F
SHA-512:	CE96557ABEA74E2E8B1F0F503768BA7EB39348292AC77A8DFEBA54A07C02E423D2999A0D3E29F812FCE90DE9C96DBB9BADF27566DCD0845258ABDC3DE80AE1A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c5e2b924b1849b88f753df728967a2a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2359548vvPsfN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.401315065987413
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyQFaTXluqjZcHBrt:qgFq6g10+f+MHkmBB
MD5:	E88C26300CFE256C274477B04264845B
SHA1:	DAA932944BEC329E48DB236B0DCD6EDBCF19EF69
SHA-256:	CC34B1BEEE7D9B3CB390BA27E60F4BCE3C2B8C8D2037638C9CD1C6A2984C8D64
SHA-512:	097DCEDEA892A446B60FCEB590779F850006671EFBCE16BAA270D1F216EA034956AF8DC0A07307EA1EB0134DB316E4060480F9C856358625DE584D3CFD755333
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8874480aa7ed45df8aa9b5cb74e8498c.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:2359561S9LjgM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5412425088165245
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyhqFDrT5jFQMzKaBu:qgFqo6g7/+0+f+MoqF/TPTmh
MD5:	DAAB0AD8C4AE0FEA0DC8CE76B96DBA2D
SHA1:	CDFA03616EADBFF5600B1CC6FE4EDED27871FC8D
SHA-256:	1E7E6B2682C08B0AF876365B6BB59AC4058625DEF2B74D62FC61321B54C41C43
SHA-512:	985FBE4A2DA79D453D6E6C5419216AC2B69667144D7F8003A83F8872D603AA0E54D9FA7F64A5165D7447EC74DDE8F5F456D5437D04AE544E0B42A4859FA57749
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8bb4b05be7ff42f691a137992b226849.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2359563dfKLPN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.494627816918811
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M46Y3WJshTjFQMzKaBu:qgFqdg7/+0+f+M4dWJshNTmh
MD5:	3E332BB7A12C7ADD415FF84BAB1837E0
SHA1:	30C8AB5C2ECC80E66D24CA3592E90A56519A97B6
SHA-256:	12DAFB36F26B40DE9CED4676C00CF059B909C35EC22824FE7EDAE59036448305
SHA-512:	214A3CF4CC6BB36787641CFC1EAA079AB72CE3EB976B089D116B0D186A4AED9B30A7C501F59A6512663BB5A48961280B1DDCD7C3986E66245E02DD1E98BE6242
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c1a21ddab214894a7a7a5d2b03e16c8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2359746WHpFpJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.32621802188156
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuOhcvREhGA8BvRxse:SbFuFyLVIg1BG+f+MuOh3hXyv8jZcHjv
MD5:	5E2D69E32D014D454C2D79E07AB1B516
SHA1:	351BD5A7A0BB49A3D6A88D9220659BA98E63E308
SHA-256:	CB9B6456252D64FBCD0F9E2A6C4DC3F7F534860644671DA598DCE88543EB500E
SHA-512:	57ED464E34F0DE0933CEFFBE4942B2B8BC24B3CDDB2FFFB2A0D9F230F6EF72729B7C7324CB7A9BEFB3EFDE0ADA941CC7F8A78B3AB84FBF6D1B9A9B8E584FB84E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d67973ba91904a95aa3e96feb976a5cb.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:2359795ymW0AM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.357633197690357
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+6ArlQXb6vsh+sjsO:SbFuFyLVIg1BG+f+M+rrlb0ZjtWL0
MD5:	D5895FB85DFDEFA46A1B3908D2E3F007
SHA1:	5D53430A42546A74CC1FC0C5A08460A5E49367EB
SHA-256:	348736CA3CE022966AC49CB3F4B9828A074517AEDB12D90C56625327BEB06FAA
SHA-512:	36E3670CB0A507E2F43AE3C1627ABE4AAA4F4A2434092BDD8816738EC519E01506B0B758A82C258EF2F0AB452621F5F6A6B29DC9782C8EC41D17845445EF3361
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4b85c5ed04194f5c88e50d7c738a4821.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2359937bCX9sM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.324751480198009
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8VyQSugAcGYs2rqjx:SbFuFyLVIg1BG+f+M8jvYF2joa
MD5:	A4E9EDD6AB5ECC3119F9952A7213BCBF
SHA1:	DA75B37D6C7CC0A8A7C957DD696A16FCB40E1250
SHA-256:	B2AC4CFADC1367C1AB1C3D9438F8E51C56FA4FDC8A989BF39FC2054F2A9A4832
SHA-512:	5C6CA5A46DFAF13D9FF4ED1B19A774F9A52B6F592B611BC6B275A40B15BE2D1BF11CD114B9905BF650C560B431A92C553984ACE69B0123DC06C224A994D99AB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65efd5d697014ead8e1beeabf80d7ef4.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:596789B97BzL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.377953561159211
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+UJXUWAyZTE3V5xsd:SbFuFyLVIg1BG+f+M+8XzTFjosQu
MD5:	92EE30946C7DCAAB4454523C187F94D3
SHA1:	8FB68EB814BDD3A6967040B4A9EC840C716DA473
SHA-256:	B7239B4653832F08B9A856E1564C28332AD7575C94F7F1D2D907711D4D8FE57B
SHA-512:	8F5C2C3B88EB41C4EC68CAE9E69A2F5A1219890E7D91F8E8473E4EB074BCE7F62E0F6321936816F1211ED767C490C8AD98E53FF142558614DC005EF1A160AAA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4b27125dabc24dd3b23e7d1e22b6a9c0.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:596790L4uKTL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.518343079305477
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MnIXQj28jZcHcljX+:qgFq6g10+f+M/j2qmAu
MD5:	9B38945B6601C201BD6E1245572AA1CC
SHA1:	3C81ADA619659E9EAB0F5A2FC260150312BDF1DE
SHA-256:	1C9688465A626AB6FE1A18061EFCFD38CFE62D7AFBC85BFD42E2CD4D5BAAEEDF
SHA-512:	C5FA26FD1B611E4B0E1678771199A43F7B745D8EDC5EDC318EB8B2F73A52A71169A58ACDDF05ACD0301D26A587F4952EA67288FCEACCEB1427771857E220DA8D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=af4554ec83424722a277285f75b89936.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:596791Ckq6FL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.410305570879115
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7bDhyWS2lsjs1Had9:SbFuFyLVIg1BG+f+MnS22josQu
MD5:	2535E01E823B2B82756254E2751511C1
SHA1:	6806BA6BA4AA697BE21E3A32A463CED43CD21975
SHA-256:	2DFEE8593B8DD3BE6420A6D66DD311668C693C53CB297EE84231453A07912E85
SHA-512:	13EDBA8E5C089060EEE1BABDE2602070FBD982067854A7F71D252A501B6991E0D5467EF063C2A9D8A3F0CA8714F97FD58049C08426D5D374EE013CD35F662442
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1be9e2c51fb44a898c8c54a7d102be01.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:596797sAV8CM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.344499778884132
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz9DaErRD6fHA0huxQ:SbFuFyLVIg1BG+f+MRDaQRD6pTjoa
MD5:	D7EE36572E243F37EAF638E1A3CD3002
SHA1:	2CA1E2F4AD8C4D2E6BFF6C729621FC84FA6A7AEC
SHA-256:	254B51C093FD779EF470CA3C17FA7A8FCC42B811CCEE88D5F11245185074F512
SHA-512:	1A602B9D30C2BE885B4AD3DC60388364FFA029669808DE1BCF01BF613B73DA55F078D4824AE7714B4594F843DF536086C0D9EBD9E1DB0C95662FABA1D787A710
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97b56fab0a0d4536af314b3855cbbb3b.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:596807dOf7fM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.365516984544936
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrgNVAvZQ2lsjsmNzi:SbFuFyLVIg1BG+f+MUkCjdCLKzK
MD5:	F909CC564816891B2C0A00DE543A95F0
SHA1:	9330618B2D0C0CADDCE5F32AF695FCF916F96D90
SHA-256:	B722C68B55684B85E2872CC249EDCB37B90C937A58C7F0286B87D117DA608BE8
SHA-512:	F1238C4B7202437844AEC69D514DF80C6380CFD20800A86CE4753D87DE71CBEE02229B7D8239AD071C923EDCAF04A46BD1913E9B7DE9A5302D06330F9ED32773
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5e9b85cbb8140ceac42d6caac792d5c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:596814KsvNzK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.363502362838018
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+LrvGAUFXg2jshQJT:SbFuFyLVIg1BG+f+M+L+w2jtWL0
MD5:	7E478767CC0A389A38EBD94CD9195C7F
SHA1:	85483F16054219F189697A434B77CF15E37C0BD2
SHA-256:	7FDFBEECCE268C3CCD79230EFA40B06BC9892D65860A7FC109971F78177FFE73
SHA-512:	45A569F0674CC2B406056A7F94EDD0943E6B361E11359E7492F0443A2ECF15ED5C21CE9ADE0B88329AB88DE0BFC33F1E8616ADD4B026B8A40A1CB294105AFBF1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=47d5260004ec46889f6f6e1c72cf6e49.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:761392Ts15M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425857652757733
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzlSRwbODlSHnTjs16:SbFuFyLVIg1BG+f+MhiwbsIHTjosQu
MD5:	08A8D9FD85FBB5C6EE9DDE9587266A24
SHA1:	5F364B57021DBE15EDAED85F717AE05D6D99EA3C
SHA-256:	64FE75926A8941F911CECC38FB6725807EBB0EF890F58CFC2257B94EEFA300FD
SHA-512:	374B60AFAABCA39D2F394074E99CC668041B22BF20162E6B4B96B65FD4FD7CD10B73FD8F37229CFF3E25CACC539444DD05D7EEEA4FF5148A3EBCBD586E9FA5DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a6bbb9698c74e3c8bfbe505ff917b5f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76146u0H0uP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.363173325732366
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MlIQrQkTVvRqjdCLKzK:qgFq6g10+f+MlIQrQkpvRgCLAK
MD5:	FA14E04488423EFDD43A5EC1A0F1B5C0
SHA1:	548E212632BB51C085786BD8439D0C6CF707D5AD
SHA-256:	DF15D898432DFA9286F2983208F7C7AFBCD3E8B5E7D77E934802533A60EACF57
SHA-512:	5BA3CFF8B4B2A4C65098E24ADEED9AE7BF602C050D46ADC08AB64432CD0CCEF9B32101E4FAA0C61DE8F1BD6DA8CCC207C3C6C013B0F29428615BE368E9F949D1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=988dd44854504661be5f0900b5e42be5.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76154z10NCO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.35970957814548
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+hTGGBLS11nalsjsO:SbFuFyLVIg1BG+f+M+FGVVjtWL0
MD5:	68299CEE081C0DF4FAEF2F4348AB397D
SHA1:	6CC6F0BEEA9F1C9B03FBFF2837D34EB2A5A08928
SHA-256:	2E3C10C05E892ADED47A9E34EBAB6F74C4E50E8BE6387999FAADF1871BCB2AD4
SHA-512:	1C0B764D38C877325F26CDC48B1ED176DC00FBD3E1D3865810CC8FF253ED1E9C3B05027D06A87231F4EBB1EB597A77563E553D592CE78DA4F10B48177FD3A3ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=486b6cf384d74c4596e4097b0ccdd9cc.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76239jqxXIL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4572840014849255
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+taQEw9c6OZsZjZcHcljX+:qgFq6g10+f+MUCpkmAu
MD5:	AEC0DB9AC5CB1D3BA577C4C79D634F14
SHA1:	23E5A56FD6A89ECA8BCF3042EC1A897D5F73696D
SHA-256:	CD8C61A6842A6961C4323BDB98739EC1784A9662396FDEEDED3DDDCA9DBE331A
SHA-512:	C8F8637428B179B27999D363430157E46FB02961B54FEE97E6CA7A77ABF7D14A5551A37D24A5B2BC6A54068C2C61E5056EE5E22A59664EE7E7030A666165A8A5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=402d46d88e404193a6e53b89a644d7bd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76247kd2PYM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.402192734386983
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsTM8lxUFdHHE3Zjsx:SbFuFyLVIg1BG+f+Mso8lxUFFHijNE
MD5:	B1F51AC69E03645ACEF3078F69092A29
SHA1:	C9A8054F1B50BAB67F653EC5D25BB6CD3BD2E0F6
SHA-256:	BDE4143D41079D9D36962F0C5EABF9A94213C55E9252F3F328D6C7089C915BFC
SHA-512:	EEB1B8157A1ACBB03CC21910AB74A3D0D97A0E48D217F3403E1BDC0FF438BE9B0B6AE103E239756A75A324D163DCF0C780C92E383F7E752700332444498F8976
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f5c6e5a5631e4a07a09e18b884a3bbae.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76373OcJKSO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.436446852928599
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4ETXqUwncZjshKJv4:SbFuFyLVIg1BG+f+M46XG8jbVC
MD5:	3960DF31FE529B920CA99D83B7C7C9DA
SHA1:	310880D5E90E166E1BBC8091724DB70A6A36AA4E
SHA-256:	B4BF66254BDDECC36A15B326C5CB93D590EAEB0E1509C159FE7C3056F1A997EE
SHA-512:	392874AB6A551FA13AA75BF2684BBCE8A7A3A80ED3BDD670256D5594EC1944CCA9417CB29B5E9130ED4A8C6A0654D4D0D8D46AF5165827CB485130EBBCEF48A4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=290e2b0ab2664512b61b838d58d4d97f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76418naHIVO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370710808878861
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6lST7QJdtYHjswkCM:SbFuFyLVIg1BG+f+M6uedt8jLkGq
MD5:	2DBDE5FD43402D63F519B09F6B493CCC
SHA1:	8245AD4D48716B45F74DCDFCA4DD8743868779FA
SHA-256:	D2B03E9CF3947BCCEB50D84543B467C8B0731D914C7A9E58BD7F04C29FDD41C3
SHA-512:	62AA2C2EDF0872AB37E992E690DEE66C668010378F31EAFB9E926CADC67ABB130036A131B286FD3B8AEA55B46D144A7FCBF11843417A34FF4D89A18B73765F6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=07376aa7d77846e4b190f1f0818aa407.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76466Uv2NGN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4291042226221995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+xSUO53WRZs2rqjs2Ax:SbFuFyLVIg1BAf+M+UFIF2jNALyAZD
MD5:	F1BC10931C07A4D5726D88F2A8665D34
SHA1:	3AE04A8B7A355C74F36DDCAFDA0F831264143FC0
SHA-256:	3ED65198C7D259E5757326B870C5505914A76A21B6AE65B0E3B184CFB8F204EB
SHA-512:	24E3E24450757DDD1FCAC95FACF2E8B78BE792F74748B84752CAE8C8158838334D128FF987A2A228212308FB396873B2D1351ED242CC19C0DD53F636EAB07FCB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=494cb0716fb343a8a7bd600863d4934d.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76523qONdgM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.487300181348986
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyYtmBXR0T2jNdQIeXD:qgFq6g1af+MrmBXWTM2D
MD5:	2A815CE448D5272AF9E180369B268E36
SHA1:	62CBE2F1CF9453940872040104276077512732FE
SHA-256:	6CD75100C3478E244DC02CF109A5FB12A29CB51801D74849884343FBFD969D26
SHA-512:	FC82BE6D5FC5ECC0670A4B432A9DC29DE5631AD334F4EA95049FA1D96496298DDCD78F267ED0DC3D7109E881C24067A873D1DF215D659B2F9F3EAC01F2578687
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8611e52193b74b05a08f3540a8abc624.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:765267P4tJL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.458273634560119
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MY04CRQUXJjdCt/rRMtq:qgFq6g10+f+Mp5QOHCDL
MD5:	DF70C1DC79CD5DEFC92C7E5DCC7A77A4
SHA1:	1D06FF6E35ECCB9F0D160B0EF5405F1882A44547
SHA-256:	E634596EEF80918F51ADE8BED362241B9A5E10004E9385FC37E0A3F538BA0044
SHA-512:	472705AC4C2B9A065553E2D7A2A205D8B93E45500BC1AA70A21D1499B33733DA6C24B167EEDE906C3F1AE5CB1F960F06D491EEB2DC6F27D1B3CDDB7138A025C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=31d6d501a4194f9692fc9df0445cf276.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76612lCIotP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.360780255443988
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4EBmLoiQfHQlsjs2BZd:SbFuFyLVIg1BAf+M4PeXjNTZD
MD5:	D4CF4A83C496ABB185C0AF674977B184
SHA1:	FB9764D846A37D7499C04C09D4F11B3B91E1CEC1
SHA-256:	4BF3CC321C3894228CADCFC35835A856AB827527019F07D8DAB456836F9649F2
SHA-512:	1F0E1E79D4347411DA7159402FF8D625EC4683B4D760F2257FE2B5C84F23A5333C1D542EF41DBC0652A25F246AFE5E367BD5694466EFC7BB35B220E14C45ED77
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a517054baf9441cafbfb10c10b5a311.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76624e5dRAM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4348581386552715
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm85jHvGLcv8jswxJBU:SbFuFyLVIg1BG+f+M8BPz8jLTTIWTIL
MD5:	8B3C48F465A0ED6AC2224E8D682D10D7
SHA1:	E3DC9EA8A53CB8531CB20D6115BD0EF88079E525
SHA-256:	00E227163563A0078C89B32B2EA3CF8D996F23DEE7474B2388AD1E90C9C9F74B
SHA-512:	B34F9A81546C93D077574857C0A088BEBEDE785A740C5088FDE1DE7236B9F4E7911562F9782E260C1C3F27F72015F3811AB857692DD087EC2CC8B541E28E648B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66229b690c754edbb033f6c69bfec7b9.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:766432cTPFN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.455956529414835
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmssDaUHlAwGjc3Mp:SbFuFyLVK6g7/+BG+f+MssuRzj0MqjNq
MD5:	2B23139CD12D5C1831FD5D203EA4D48F
SHA1:	92A8D2D7BABD994F7B199E05B7CD2379CD2D467C
SHA-256:	6F385ABD6DD18FD7A0DC01E0EA7E0FCB3A4D9B58E89E29D350F3A0A43D0FD183
SHA-512:	8DF66FC1FACE5C1ED735975009B67424D0DE6C1C9AE20623D9BBB5C235033AD1386D9B7BF5CD7D034DE1D78195CCE6F9078466025F1348A1744313AC7558067E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f98f313ef51b49c7a6ec9bfdcc0b4925.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:766444yqsML

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4552298142862385
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Muekf0CAKAuqjNq:qgFqdg7/+0+f+MJkf0CrRwq
MD5:	21A4416F043444BAEC45BD6AD329DBF9
SHA1:	EABAEDAF1133001FE559F38320B04E4AAA718DDA
SHA-256:	D1CC7770DE77564BB499E53DB95F0DCDAD87B94B5C6B7D73746B2AEAFFA29DED
SHA-512:	7056C8A16CC06D0EEDA1428BFDDE9FAE46B4E7A28BD399D519C8044FA8D5C646DBFF5D5E76793B6B8239565991752EB5542885D99BA10055864BBC92D97A9A21
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3f651c79092486e8bed827e3f1c11a9.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:76663npGJsL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.498767820537744
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MovoHdSXrqjFQMzKaBu:qgFqo6g7/+0+f+MoQHdS0Tmh
MD5:	3FFCE519758CAB4CB58D61CA309080F9
SHA1:	22D4EF34C49CBB3B9CFF7418AFA939A806016398
SHA-256:	2F3F0C0003524C91E84BF37C12A2B1D0C3B6A0137B7FD002EB7B9C7F71AFF80B
SHA-512:	DFDE56B1CCB48E4CD8BD50423CD8A083F995D679860B78C663C5E9EBEB7D64BEDDEFA30CDE08F23EC89F810D525BCFF9C01F68EE481707F4050CB61ADBC41B0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b1b2f50b7d96450b87d32db3afe3dfd1.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:76664Wc2etM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.514895544099233
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M69XS8sjFQMzKaBu:qgFqdg7/+0+f+M0YTmh
MD5:	C977F6F4CDB03837654803C1C369A41A
SHA1:	9D849B6FCA3C81A7E3203B6828C1BE703FF06D36
SHA-256:	67E1410621B7A6FEC9E7344428A8ECC920B74B2B60D949824B5DE4A728D9FF42
SHA-512:	33BA2C488534F2330C08EFE66B4BB838F09B78D380BD603A14E4762FCB874113504B07B1FB32862ED18AD5689A15820E4ACC225FDB047D3D98B87EB5FBBE540F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f614e6e9de24cd6b7c74c5eec98b0e2.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:76731v1nNkN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370911981859467
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp02Zb6t6Ag2jsmNzi:SbFuFyLVIg1BG+f+Mm25iTjdCLKzK
MD5:	BCDD120A0148C9A9BB787F443B173000
SHA1:	C500FD2DFDDC77F759B578222A54FB6A363DFE12
SHA-256:	D7610EEB8C4E49A14A127238B27E8FF8328E7AB0D8F9E177BE4031675B3EECB6
SHA-512:	ECDAC67FE365DE723289E4D4A7A46BCE5CF97CE02DC2783BFEDC38ABE4285A2B52C36A76055FE997E34A8B6A0B6A1CA0F539FA93426D2744E369A7D1699494B5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca88179fd30b4d0e95f571030d20e995.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76831oqbwLL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.486948241426938
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+aDn4pEeYglsjs7LH:SbFuFyLVIg1BG+f+M+ave0ji4s
MD5:	17496AD8A8C28ACAC522CF610110CB64
SHA1:	FAA60A2B2CF2191A143D82C9FF3CF090E8E22808
SHA-256:	672FC284D6E15C9CF7A6E3240FB8301658AC979B514A79F04FFC69722DAB53BC
SHA-512:	FC2756C7C4DD918AB1113A165EED0E44568974187DAB2D93FC38966371C9CE08362FAB538B8A2E668C197EE626BF14CF598FADCAA2B742A48B31AE2D20B07743
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4fc0df60ebb04a8199a36a7398aaf2aa.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76833Hby6yM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.561109316948748
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm66W0QJxCuUEUwsjsv:SbFuFyLVIg1BG+f+M6T0QGuJUji4s
MD5:	A578DC1A6F71BE6E1B26B67E783E9AD5
SHA1:	08830B905429EC532294908B44BC4EAF122EBF5E
SHA-256:	DA1D5350B00BF6C603BF87572F59CEBB0099F643B1888F44EF942B8A504F951D
SHA-512:	CA5631EAE756D0947FCA2E7E9F75749B784BCAE800153BF7151AE985A274F536DD0EBC837970E4850DAA43A2C7B6879F9C2B132E3E8271E017CCF94AA8A21CCA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d317d77676247559b9e8e2fe681324b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:786762fvBaO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.423926172066215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrRUEfRQ+sjs2ALAXaGS:SbFuFyLVIg1BAf+Mvf6jNALyAZD
MD5:	F1998CC87F9B09DC4AF2A46D67B496F0
SHA1:	B4826EB0608EAB20ABDC7627B7B22FAACF8A00ED
SHA-256:	76A61A2065F1846ACEEB2FACE912979B9E62047C819B81C86DED922343462517
SHA-512:	86AD0C46358BBC49E3CBF6C3FBE3EF2AF48DC3E8BBB0C375E4911246E6B81F73315345351A382D21EF08849D865EE089B48131E65957C40D35BF98FBBED34DB0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a8697f9a2dfd498d940642d2651404ea.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78760anNaTN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.482775923328213
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M+aaHwUHV2jNdQIeXD:qgFq6g1af+MXaHhHO2D
MD5:	EF67F92A554E304B26CADD985FB0B537
SHA1:	6B50DB63F4ABF8A2A3209C53CEC3910116AC80A6
SHA-256:	5E2FDA14EB628866FAC26BDAD1B3F78D8F219C0B62F4F657DDA77B8C74685029
SHA-512:	DE23C44A6936A0AA9458A334A51EE6FDDA1BEA9E848D6D64B9270E7C6BC6BBCFA2127BCC016F3C2B269269275F85D3CF3DD2CD098CB8E8F0A2864758FE7B9977
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4fc6986846644c58b581ff231f26bf48.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78953C6WHuM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.401126177014912
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+2TGATcX1y0Zjs1Ha:SbFuFyLVIg1BG+f+M+hX40ZjosQu
MD5:	D083FFF4BA4EA372A83E9C587F4F88A6
SHA1:	84CA3AAAB37052B8FA301C26AE792F79C9F08EB1
SHA-256:	9EFA784DE125D5B38EA849292F853097952B95E91583F5F285E23A36A866A2AD
SHA-512:	CE45C6E1EFEEEBCF8CB47B9FA65552FE515CF6746ADFFAE7B80F745481261C33096E50DFE08A372848D64B93C49F6B781FF6C79B671D94FC293A1A9A39063DD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a6649cd4481412cace699329a434529.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78961Jyw3wL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.418898729966862
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Msl+B4UR9BZWjLkGq:qgFq6g10+f+MsUj/7T
MD5:	CE37E81DAEDF651CBEE1E3CE20319AB6
SHA1:	6BD009DD2981E30E6407BEE66BFDF3EAEB5BEE73
SHA-256:	A327606DEBDFACBF5FD12C6C7B5C326D1E1664F30CDCE07C8AFDE38F6F8C82C3
SHA-512:	294E4C8C38AFABAE9274D65803C6FD55585300E7C43E8379C982E9B136500F913EECBC068DC706B66ADFE59BE737BAE8B60B851C4DAD2053CD179160C0D24C69
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8d246cfa5d54414a135b0d39d1e57d6.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:789809hzgkM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.330573714909644
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6oAUYPXk45PRxsjst:SbFuFyLVIg1BG+f+M6oxYLSjdCLKzK
MD5:	6E6E26BF94BD90092AA61A3F1301487E
SHA1:	B200F75333370BC747A9B0B2B199DF1F84AA055C
SHA-256:	254A0E792DB59D6E42290B7FECD1D7D03F054BEA2FF26431F4A3FCF8F76E96F0
SHA-512:	642036E83157072B7E154215CD21969971F3C8C8DA7A17CDE3F09F8A2868EDEC10A4F37BC8F548E51CA680C2BD2AEF78C036A35CD35969F7DCC81FDA13EBB303
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=06a0e1c8e3874feabe255501ee8f303b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79136Zm9B2K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.442650906262774
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MGkEbl0FrqjZcHcljX+:qgFq6g10+f+MGkml0FrkmAu
MD5:	FC70FC28B3970B21F807330C942963FC
SHA1:	E637A69A4CBD54DD1857D95F8994D9F6D01F5EE8
SHA-256:	4E3D209F49A070EDD149985F5324C52DCA9A97A16417BC50438761F098CDFE37
SHA-512:	D8955824FA2136E7D11E81416218C1837CB7C02DD9115CFDCAE6CAD0D7AD2CCBCE799C38981B1817BBBC965B35CB6662832BCB2DC99B13D42576677677B76C85
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75ab3aef10ba434a9e8c4ed74ca88c8c.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79182X4Pj3L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.390577609720019
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpptYYGQHxuxsjs1Ha:SbFuFyLVIg1BG+f+MnFcqjosQu
MD5:	8D42F7732C7ECC50AE0E0D6D104C264C
SHA1:	85EE06D60E9E763970E6DD46B87C8C154FE8F311
SHA-256:	92AC3BF56792169A082D085F1B471F9EB83488C36430D2FC9B456220571D8EDC
SHA-512:	02F12771C0C3A65A7A2957636A876F25A7F508D498C5C4B9B3E8DE03DC60035CC01982346A54C3D6E62A7146D64B2C2DC1A0BE39FD60DC9E84551523DD1140CA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4d0f6a5611d4cf5a56001fccb57cb8c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79194zUnzmP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.402706107109886
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmumcWdOPdbAAvXsjst:SbFuFyLVIg1BG+f+MuqAPRx8jdCLKzK
MD5:	685818D192D0CECF22958FD6354F6C30
SHA1:	1D47ACF709B302323C1D6EBB0AAAE16B1FEEB092
SHA-256:	3C1A6FD14D7F531545D4005AC1599E1FB0E387A33E9CED86BBDDBAAFBE6A5EDF
SHA-512:	4321CB403CE252EE17B9BCCF8E2947BAFE01C6CCF4778B191EA6F8F42F71BF3FE19011CD7471712E99CE03F5CB7F3528B500828D7806B80C9A66F3BB39D9AF4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d57c9a9c2fdd482b92fd83fa8727e81b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79316Call5O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.399253638063682
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsBTqERJpOxn2H7Tjx:SbFuFyLVIg1BG+f+MsBJRJyn2bTjosQu
MD5:	9AE5D1CEFDC7EC80B45AF3D9956597C5
SHA1:	B5C1A2D8E963E428C3653672BDB212454BF77013
SHA-256:	530743062D667874B56CB85FF8672EFE6EF5B84D2F985D89C5BE803148346FB7
SHA-512:	E18F61F8FCA8345CF955F4D24BAC7366D17A98BCB395F1E5159E4E501E5FB8CD74DBB359F3C21A017238D82B633B3918BED855B98C4550C750DEE11703AAFCF4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd60e18415564ea5b2212e1343de6b38.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79401OGbiXN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.484471472422825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyBVBfE6CDrMqjsicN:SbFuFyLVIg1BG+f+MyXKeqjZcHcljX+
MD5:	CBCDC077A4D7BAED42B0832B652C7915
SHA1:	ACAED05AC55C915DF4DFECE4F8328F8001F838B1
SHA-256:	5E099F4CE0E74EF2C66602880D2C28818908599A93B42A4224BA214818660EB0
SHA-512:	AB6C9E4CF0DC638AAA9033335A80AAE86CE4619FC14813FF61846ADDA4140A56852F7AD46812C439E8A3105B8936BF58B775C27B2173FA1130B00984283C6E00
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8715c47187ed4cb9a4949ea176fad25e.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79796JUyxgd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.490371929007863
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm47FUqA48zC11vsh+3:SbFuFyLVIg1BG+f+M4JCUj8ji4s
MD5:	7F0358E14846766A447A890ADAA57306
SHA1:	F002A3C0E3D85F132920228AAA77A1F646DB3821
SHA-256:	3AF475FA6E44D9AC8686CE5D2215DE25AA1A8F5FE84667C588D832099A91D612
SHA-512:	D9C8748B4AB17CABF9C66E6AAE6CD53D1EE67508FA3E210C5B2774AD7412E3F85966B0ED1A547310500657779A45380572D86096C12B4607CDD5801EA48C50D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=248551e235ea4b038840b74b5be24aab.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79804v7SU8a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.412321491725271
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8A0XdEXENcA0jsmNm:SbFuFyLVIg1BG+f+M8A0N4Kx0jdCLKzK
MD5:	E38B79E61F0A9B880F3B6186FC54594A
SHA1:	102418EEA3EADB16E395EF8CA624C057004FB68B
SHA-256:	9BF4843AC55259D588DBBB98751340B070DBEE7373DF8F613D4EF657F2B1B166
SHA-512:	49784224D613DBD4622F9032737E33B59EEE3F945178676EA5475EA176F8B2DBBF194671D8D78D7354E9E88F0AD98EAF5AD257664E1EA77F87575F6377C6D628
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=650ff92901cb464cb44ad3ca7847632e.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79805oDQLHc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.385045015383176
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmugdUQigjr19lsjs16:SbFuFyLVIg1BG+f+Mugdnj592josQu
MD5:	F864ACAED70680FB89B6A603028347D6
SHA1:	CC13F3E9278E3D60E42B391D2B4FCD01C5FAE696
SHA-256:	2DEC2DD99C333F3E0D77534FD99BD34600353D63CD7667E6D79D20078E5DBCA9
SHA-512:	7679E6E3A29CE58EBA0AE425F757DD8F3D25A529B878DD46CED490338D40525C8DF58606976285B2BD46662C440D6E3A617FEF2D77C5C197B3541C5F35CE9E89
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd4448782a52499ebbed0880a4123942.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79818gOEDFd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.503592567951675
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MExynzTS/SwNuqjZcHcljX+:qgFq6g10+f+MEEzTuSPkmAu
MD5:	00075AD8AA691461EEB5FA6D064F269C
SHA1:	7C49A816A9A45AC91306F8921B3077E361C1ACFC
SHA-256:	C030AD49864BAD37BA74DEAF9275CDD508F9901BE1B5C76E549A4AC4CC4E0C64
SHA-512:	B7A73C1817EE8C0644988C01F16C7E7573F4F6020A64FD9D7C29808B523E3DCB48DCEE47591CFAEF34BE21B0D6E696E456CCA9360121073CA30B35A421802849
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3b98ec4de6241f3b3cc0671a8275a39.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79819Uum0Ec

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.362367840160063
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyENDPaiTWQ022jsmM:SbFuFyLVIg1BG+f+MyEZaHZjdCLKzK
MD5:	C49BD661935D434CE3CC2A15180F2FE3
SHA1:	9ABDC1D13699475587D3B4FDC88151646CE90F31
SHA-256:	5197B855E8582F3504786098B60567BE0443693CC9E26EE013065A5605A58FA5
SHA-512:	38CA95C5F8E7919754A49DD5AF1E844B98A1951FE51A624E88808ED3352927B5A15DC8152C732981977EBD573B2D56B63CFBC029FEAD465621249B14E0A9F289
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=821e963adf3f46d3aed67c66f434a635.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79820k6KHgc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.422942167226467
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrWfXjEVXNSdDGWHZjsx:SbFuFyLVIg1BAf+MywVXAakZjNALyAZD
MD5:	5320D0BE61D4277AA321F496EC167280
SHA1:	201D1D6EB88F630238F8207C28EDC57FECA1A73A
SHA-256:	AC3870F1D470529A3C3923FB5EA2BF0551503C42B6C2DA7A1EAA026491CAF361
SHA-512:	56715A2A1DDE3EC4CB2FFCD310FB7691328F603B6F8FE493C818A8510D02FC51B08D4E66A0E36A38DB2F3434EFAE15EDFCD0378455C1F1A0D38DFBA74B501AA7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=acd1c3e2579c471da5e2289428fc45f5.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79829mApF2a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.408413275416104
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5WAO51dXEWWbXjswK:SbFuFyLVIg1BG+f+M9OXVajLkGq
MD5:	E0F748F18B6D690D1A820D5D115E469D
SHA1:	44B02E039A4B3C3D213A108BA858E59D916223D3
SHA-256:	C98C8F709ABAAFACE14B8C79ACE070D9EA08DC8518C71C86438917A570A495E4
SHA-512:	90BE76330C35A307AE201CDD165878766403D40E80DE4E718934C51105817AE99AC49FA95C3946F464E2F212E5E2FBF1BD60A12200B245CA5AA4225F42F7E9B1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3df9ed5e013b4ea982183b960e773496.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79836IrIhYd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.472976513238499
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuMdqZfBuxsjs2BbQIeT:SbFuFyLVIg1BAf+MucqZZTjNdQIeXD
MD5:	0001F4997FABEEFCE5F16DC0C2CB261B
SHA1:	63C1DAD3413ACCCB8AA225A86FB9C8CD9B7AF001
SHA-256:	37D001FF514BB20CF93032D150389353B99CE0A436EAC406DAA95170DB7F258E
SHA-512:	61647FC8A49F38BDE5B13282BC7469E03AE7DDA049AF08A2C9B3A28FDA348891180BB94F78F470517E3990D5B6E3AF223E594B72B33AFC5DFAA2CD34EA59794D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d29b6d48af6c48a4abde5b6b97c96480.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:798419toY5d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.420709733227168
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6X7ODhd0SgGvAuqjs2R:SbFuFyLVIg1BAf+M6+5gJuqjNTZD
MD5:	18CF8077A143552561577CE800B13B52
SHA1:	E139F34009D6AF0D8FD853394594EBC22AAAE00C
SHA-256:	004B2AA8B7DF65BB2BFC372616D9F2A7C999FF485F8E79FAC10566F526EC8D14
SHA-512:	91D4B714E27D2EE4FA5901E77330A99B82856C62F42723C92D17BFEE22CE922B34CDF2C2B5287F0A5FEA00BD5CB290CBA9A380A71493CDEE6768F980C9687043
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=035a6543c9174ff4b89ca7bed1f6d705.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81185wdwnX9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.426038359642389
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MHWfof1E8jLTTIWTIL:qgFq6g10+f+Mj9TEWEL
MD5:	6CE54A0B33342A9582049B0F55AE7710
SHA1:	202496F5070BE53F481337348F44D940517164DF
SHA-256:	F11AA2ECB537F63C1AD2ABE1E9544D6578590DD4F89E685789D78257BCA8F53D
SHA-512:	6DF6573B5DB95884E2BB485D57CDC8667786F6B3E470DDBDDF0CEF11D17CED2120B3540621604FB742DFA0B1A268B416EC6B4C95804A17C054DFDC466D3675A4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=330293ff6cbe48819d1391f121fc2098.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81200v8cswa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.430656165086194
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrXMUTe73OZjshKJv4:SbFuFyLVIg1BG+f+MErOjbVC
MD5:	D071B4C8FEACB6D189839DECD0D4576F
SHA1:	34129DB852DA249F15D68175ACA58A1639858720
SHA-256:	580545223840A70CF91E91365367CF33052146C4E5E7ED969BAEC72606C6F1B4
SHA-512:	0DE0380AB90ADC1C4B1014162E8350DC29B9D7A951CDD6381858E25948C726CF7ED785C69E98F3A25ED123C2A650BEF42F9F4AFCCE4A5597FF5446B6215E11C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ae2ab3f8c5db476c86202178a1049c6d.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81229VuFJVc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.381433098770529
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7/bphglsjs2BDf8:SbFuFyLVK6g7/+BG+f+MbbY2jNq
MD5:	9F0C0854B70885B245BBC23F70A56317
SHA1:	C932715EFC5CB7F2D5017FEAD022132C9A9590E9
SHA-256:	13A705E822017E9A8DEDDE523D2430423A829CE32C1281CDEF26B966225D2681
SHA-512:	47583E2CA6D7AFD83A86BEB818BF597D528A515BA4FC62A2E80C1EE9BC028729B6182FDFAFC94425E192ECBCDD836111A6DA9D0FF756C241CD1D62F95FB27355
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1ef1f025bac54d1da14af0cf8187eb0a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:8123027H5J9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.373690662850906
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm+sBW8zjs2BDfAXv:SbFuFyLVI6g7/+BG+f+M+gLjNq
MD5:	99F5D18A4C880879D1D5E4733CF87FF7
SHA1:	47615A835CC74FDC46D9F469EE5F2A7F96D81093
SHA-256:	998588E355FC1B0EE1DA42C91B45CE1794199922371B891BF1810E67F1643C19
SHA-512:	252C3F6EB26A8BD225F517A866F66BFF4E289B0E4E12367C1FC9249601D8B8E92CCF1069EF14B1A900851CF08D97287F9156CDBBCF959A6A747F3DCD0E1B19F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=480d391bd2c04d07a224de44406ab82f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81262LV3Okc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.479953149753302
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4A9++HUN2jFQMzKaBu:qgFqo6g7/+0+f+M4Af0NETmh
MD5:	6034FA3054FD7D07278CCE73CE36E343
SHA1:	2477EB2E7980ECB07934EB0779B706E8275EB855
SHA-256:	EA689802D0C55A9799AB5F265D91BB800068ACFA351607E3A61F3378A38059C4
SHA-512:	6C8B46A979C6A0198ABF02D102913117B11E2CE5A3967860E86CFDA12BE74EF34D0D98C326725946AC60793AA1AFF48A2F597A23A264870225350EFFCF116CF0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2324b43344b646609b071a92f1644db1.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:812633VQeFa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.535237152012525
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+lOfjFQMzKaBu:qgFqdg7/+0+f+MqOJTmh
MD5:	13184AFE07086BC2E9B2232D69145318
SHA1:	1B4DFB4A8DEFF803E6DAB6AD49D316C1157FA527
SHA-256:	AA84864BDF1DB2CBBF8B2F35C83D91BFFCA167A4408E8D5B52332C7CD50C9F6A
SHA-512:	CB1160EB090095DF3BB89B2DAF120761216EFF6096F4A1DEEFC826D21839F666965198EC3722CA25EAD314F1FF1610724D98328E216048F13F307BDC189FBAB2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4cf6156675be46b89930ddcd0a122e56.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat0BQmkrb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0FvU2xR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0JJ6mMa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0QUGQwU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Rlk2dW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rW2wFC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wP1j9T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1270PVF6Q

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1276KSsfT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294918960187928
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8sJghbQt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEsJglthQHtPYq9M
MD5:	2DF3F0FCB8E95924F4B9691A715BAE6F
SHA1:	2999C6F1C88FB8D06D9D49990BEF6B5FFE7E276E
SHA-256:	B624790C5A53AC5D42D6D10FEACA114BA2A54304EF326F780913D1762A510465
SHA-512:	20515FEF453A192E305C490A97C9C0CC1ADEEDDF554983678E50F49D3530C204F394B4F30CB514981C06D89614859BE5B2E2986C0CAD753013BF5C476DE3C834
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14007.REALTIME=1735410218082069.MONOTONIC=523472225.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#12775EjC7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294722940586919
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8kJga/Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygAjthQHtPYq9M
MD5:	8B25DB535DD72C6C12A5CB8B56F99FB6
SHA1:	6C9961A1B6D6D017CC418E745CFF767E0749985B
SHA-256:	6E56616EA08AFD79F3966199B5709A6286564F4D2DF64AF2DF6A9AD0A2B60A07
SHA-512:	D4E9FA43ABD2030CEDF8EBA6F02F1B41D7114D84E08F69BDF772D572FB8CECC016D7FD9E3D3707B32B455FC46F104F11527D4FF08C3C5BE98BF566A50EC1162C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14744.REALTIME=1735410278415516.MONOTONIC=583805672.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1277qZeI7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.469084261785496
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff81JgaR5t6U:qgFq30dABibBEfgo5IU
MD5:	C51ED88974625DA520654A55CC2CB60F
SHA1:	ADFF293762AFEBFD7F70244B1D223F94C7EEFDA7
SHA-256:	2E26AD850A8C7EC3483664A24DC1F718B797874DB0E233D40A66583BFAAFCD05
SHA-512:	6B35B5F4BDB0400F0A92249269206E90B857E61FFE02F8AEDF626B9B00F6EAC0996634C548D55C69BF78B8A1DA743804CED16CCDF0B3A468D2E32BCB0D1A64E0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14806.REALTIME=1735410278415516.MONOTONIC=583805672.LAST_SESSION_TIMESTAMP=583866684.

/run/systemd/users/.#1278ileJ8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3124463195530405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAXjOx4/AvK9H206qodjavv:SbFuFyL3BVgdL87iesnAiRJgaR5t6U
MD5:	0FE4A79A91860B2DD63F6AF412FDBFD7
SHA1:	5DA541BCEA33A04CEF10B5EBCB06C02D689B0888
SHA-256:	B65FD212ED361C6672359660FC9FF4A394330BA37E1181C2926EC2B4E28B288C
SHA-512:	03EAF78B7BE067A4A8D6DAE0B5059FAA61701A2622E01AA180DF1F27C6071B48849BB13113CCDDF503E0876EB0D869104CB96651F0E78F46340B856D8A8A85AE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735410278415516.MONOTONIC=583805672.LAST_SESSION_TIMESTAMP=583866684.

/run/systemd/users/.#1278xEVdU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297308245385502
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBg5db2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgGthQHtPYq9M
MD5:	7717E900FBAC654D74505DF580876BDC
SHA1:	FA9F3F51A2C08F9B8F26B772DEBDA6D49EC51AFE
SHA-256:	F1C5EDF780C0D9F8234D60469C46D7DDDAEE1CD056DEFBCB22A380E0B69657B6
SHA-512:	FAC8EB8E07AAA4BDFEE20AF9093FA7BC93EEA0D8BD76C993F02620AA5A1BB8AA4B6808C41B437D0E713288F4B0E80A5781948ABEF7734BDB26A26786384205D9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1735410178253672.MONOTONIC=483643828.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1279iMFfU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127LG50T8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127MniZ2T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3227926934598235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAOVsw/WuA5206qodjSHf:SbFuFyL3BVgdL87iesnAiRJg5dA5t6FO
MD5:	960888AF8DC0245D5D9F63D4B7E1700B
SHA1:	9394ABEF6BB2E2C009C2D8463F17CCC6B2778224
SHA-256:	3F7A3E11AD12E81354EAF9A49C18DB681F9B1C20436FB2E7632F0CFCB75248CD
SHA-512:	6AB68122397DD5598B58F77A5F993DD8F10FF5AF555DEB9EAB9D4FF91716BEB975FC119E8449528B96B586D84937662E827F55146D6B2051AD1EA9BF1F746006
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735410178253672.MONOTONIC=483643828.LAST_SESSION_TIMESTAMP=483722961.

/run/systemd/users/.#127PmM2cS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297308245385502
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBg5db2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgGthQHtPYq9M
MD5:	7717E900FBAC654D74505DF580876BDC
SHA1:	FA9F3F51A2C08F9B8F26B772DEBDA6D49EC51AFE
SHA-256:	F1C5EDF780C0D9F8234D60469C46D7DDDAEE1CD056DEFBCB22A380E0B69657B6
SHA-512:	FAC8EB8E07AAA4BDFEE20AF9093FA7BC93EEA0D8BD76C993F02620AA5A1BB8AA4B6808C41B437D0E713288F4B0E80A5781948ABEF7734BDB26A26786384205D9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1735410178253672.MONOTONIC=483643828.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YFx7W9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294722940586919
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8kJga/Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygAjthQHtPYq9M
MD5:	8B25DB535DD72C6C12A5CB8B56F99FB6
SHA1:	6C9961A1B6D6D017CC418E745CFF767E0749985B
SHA-256:	6E56616EA08AFD79F3966199B5709A6286564F4D2DF64AF2DF6A9AD0A2B60A07
SHA-512:	D4E9FA43ABD2030CEDF8EBA6F02F1B41D7114D84E08F69BDF772D572FB8CECC016D7FD9E3D3707B32B455FC46F104F11527D4FF08C3C5BE98BF566A50EC1162C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14744.REALTIME=1735410278415516.MONOTONIC=583805672.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ZTSwkR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.31735869295691
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAAb511Ktg206qodpXRv:SbFuFyL3BVgdL87iesnAiRJghbTt6/Rv
MD5:	9176B8CD315F14D0B37B3FE2B8F5DA7B
SHA1:	F298065B4B3E3A0B1BE934B0DBF97EC9335DA975
SHA-256:	48CEE33107F940C0F3571D551CB85192B7F2D73F53B753780F59BB02DAE67987
SHA-512:	EC7CDF73E7FC441E6CB695A3C5113EFAD25890DC7A1A11768F6A4372568172ECC5C5B7980BABCFAE8E49149C536CCA128EB92341C441F9D50DE26C835D0D6785
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735410218082069.MONOTONIC=523472225.LAST_SESSION_TIMESTAMP=523568208.

/run/systemd/users/.#127bWCbiQ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294918960187928
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8sJghbQt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEsJglthQHtPYq9M
MD5:	2DF3F0FCB8E95924F4B9691A715BAE6F
SHA1:	2999C6F1C88FB8D06D9D49990BEF6B5FFE7E276E
SHA-256:	B624790C5A53AC5D42D6D10FEACA114BA2A54304EF326F780913D1762A510465
SHA-512:	20515FEF453A192E305C490A97C9C0CC1ADEEDDF554983678E50F49D3530C204F394B4F30CB514981C06D89614859BE5B2E2986C0CAD753013BF5C476DE3C834
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14007.REALTIME=1735410218082069.MONOTONIC=523472225.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eJDd0T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.488408254830857
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8CghbTt6/Rv:qgFq30dABibBECgdIx
MD5:	E64C82D7BEF2A93BA1261F035B77F5E6
SHA1:	FAB28EE0571D0F003A9988842452C4E9F88EA557
SHA-256:	996DED4D31377A674B7927CD7E9122C094114006D8F54E3216E41DE88ED24E70
SHA-512:	F0A062080C9AD3D15E0730A53E3009E2C4A23E84D1BCAA48BADD045D74433B41C47707E0A97DB3071E212F57A38CC099ED219EE8525B8938ABF31493367B5CBE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14069.REALTIME=1735410218082069.MONOTONIC=523472225.LAST_SESSION_TIMESTAMP=523568208.

/run/systemd/users/.#127qzsoO8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.469084261785496
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff81JgaR5t6U:qgFq30dABibBEfgo5IU
MD5:	C51ED88974625DA520654A55CC2CB60F
SHA1:	ADFF293762AFEBFD7F70244B1D223F94C7EEFDA7
SHA-256:	2E26AD850A8C7EC3483664A24DC1F718B797874DB0E233D40A66583BFAAFCD05
SHA-512:	6B35B5F4BDB0400F0A92249269206E90B857E61FFE02F8AEDF626B9B00F6EAC0996634C548D55C69BF78B8A1DA743804CED16CCDF0B3A468D2E32BCB0D1A64E0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14806.REALTIME=1735410278415516.MONOTONIC=583805672.LAST_SESSION_TIMESTAMP=583866684.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mRJ:mf
MD5:	6C79FBCA98BE0F517E20EFEF0F6B0C1E
SHA1:	D54160F3B8F8B251C73F08D6D24A1E4158A0DD21
SHA-256:	69280E36735E39E2047611D7962EB80994EA7A50C7F856696AD7B84EBE049488
SHA-512:	4BFDA598D4C7B3D2AF773FF2F8351B04EFF824EF6E1F1086DAC2610B8779C6B629DFD660586CF5161F7D00E7FE60D73AC6337B33BCCE9CE8AF31B9BEB70CAA67
Malicious:	false
Preview:	7044.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:7AsXlXEWtl/5gl:7h+ylS
MD5:	28A24E2AE30639C43EEF0EFC7BF89D54
SHA1:	66720D33A88DF38665A910F00C5A57C1BA49C1E2
SHA-256:	0FB97C60C7F4AD8998951FFC9D38EA169FE594F58A0BDBBF547E3572B7B3F3D4
SHA-512:	A98A3145C4794EAB9164741CF5298D4A6976C56E5D9046BBA3063B65F27CEB097F17AB55D21A5857FADB0D41D6C0736B5F7BEE73B487CE7F178D891A50F7A35C
Malicious:	false
Preview:	....E...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................E...SBpg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nj:j
MD5:	F6DC68640E717E025E93E292442BDEFE
SHA1:	E8B10BF70A1FDD0EC89A3157215D6B8089E01307
SHA-256:	3BFFC358377392999D2F89D936760D775B53084199945CE81A9B364CF8732CB0
SHA-512:	9F59EFDE448572A793D6D681DEB5BC2E8D1E037019C4EBDCD96BBE9F24047053777D3D91969DF20EB32F6181881D21FB2C3BE6EBFA0FB860D590E5DDC0404840
Malicious:	false
Preview:	7131.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nAvn:K
MD5:	965DA7E27DFC182C7AEC7F3E8781E5FB
SHA1:	7A8390C81F3509D091CBB7609F160251B51F8993
SHA-256:	4FA7C16BBE7539317D87C29F940D11AAD686FBDE53C81EF8B6208E19FC347123
SHA-512:	8070D8C9AFD01A0D4EBA85273AD3F94DEF63A337AC4AADD05CA323FB43849352AD9747E7346DA93BF380FA746EBD355AB325C4AA392332198D2B499DFB88BA56
Malicious:	false
Preview:	7125.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.521928094887362
Encrypted:	false
SSDEEP:	3:n3uv:3g
MD5:	5034ACFEE31E60CA59A68E7ECA251E57
SHA1:	12EBEF845915E2044537FAE314CE9A03E73BEAE1
SHA-256:	AA23282EB9F62C75DB964B7E204D81FB0C955BF1F25B55D2936C65755CABBB2C
SHA-512:	238A0C7E28EB22E2031D832D62DECA63F8801A7BB91AEE4EA59A94A04C7E074077052C719C2B1D0D1AA72F8BA7A3E20EA8892410C696523AD4C6C29C91FBB0C9
Malicious:	false
Preview:	7108.7109.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nj:j
MD5:	F6DC68640E717E025E93E292442BDEFE
SHA1:	E8B10BF70A1FDD0EC89A3157215D6B8089E01307
SHA-256:	3BFFC358377392999D2F89D936760D775B53084199945CE81A9B364CF8732CB0
SHA-512:	9F59EFDE448572A793D6D681DEB5BC2E8D1E037019C4EBDCD96BBE9F24047053777D3D91969DF20EB32F6181881D21FB2C3BE6EBFA0FB860D590E5DDC0404840
Malicious:	false
Preview:	7131.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nAvn:K
MD5:	965DA7E27DFC182C7AEC7F3E8781E5FB
SHA1:	7A8390C81F3509D091CBB7609F160251B51F8993
SHA-256:	4FA7C16BBE7539317D87C29F940D11AAD686FBDE53C81EF8B6208E19FC347123
SHA-512:	8070D8C9AFD01A0D4EBA85273AD3F94DEF63A337AC4AADD05CA323FB43849352AD9747E7346DA93BF380FA746EBD355AB325C4AA392332198D2B499DFB88BA56
Malicious:	false
Preview:	7125.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.521928094887362
Encrypted:	false
SSDEEP:	3:n3uv:3g
MD5:	5034ACFEE31E60CA59A68E7ECA251E57
SHA1:	12EBEF845915E2044537FAE314CE9A03E73BEAE1
SHA-256:	AA23282EB9F62C75DB964B7E204D81FB0C955BF1F25B55D2936C65755CABBB2C
SHA-512:	238A0C7E28EB22E2031D832D62DECA63F8801A7BB91AEE4EA59A94A04C7E074077052C719C2B1D0D1AA72F8BA7A3E20EA8892410C696523AD4C6C29C91FBB0C9
Malicious:	false
Preview:	7108.7109.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/tmp/qemu-open.pbAIE8 (deleted)

Download File

Process:	/tmp/gnjqwpc.elf
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.060262039120377
Encrypted:	false
SSDEEP:	3:TgIPhGxHJN:TgIaJN
MD5:	3CE6233A37CCF121B6A88BAD88E621BD
SHA1:	FE7EE8DFE57D8373882D61547998F23FCDCF0FFC
SHA-256:	E973BB6847117AA9ECB410974531A12FC2E2964299896EE25C25591A57204D2B
SHA-512:	5BB96EA9706354E8E1A8DA1E286C3B52BB1FF9A5DFA04CCD87CD6328804DDD853F84DC21C455739C3AE11F7A649635EC0D84AF0C6D938EE31C9FC0866BC42726
Malicious:	false
Preview:	/tmp/gnjqwpc.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.32Q0Z2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.BAJLZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.P9MXZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.904578241518844
Encrypted:	false
SSDEEP:	24:3IZeauGmXiAvlA2+VUyI0pYrdJrKBrCQU:37vafV9nYr7rKBrCn
MD5:	7D120A52A18C418F55A10271F5C1A241
SHA1:	9228F4463000629756E4EC1ED4CFC9179171AA66
SHA-256:	1B31FDA5FBB448423B054B6DF71ACD9058E9CF44E4B5A81C9A2826865EC07036
SHA-512:	307B4DE0B1071DD6797BE74D2B2652DB00E7ECC449AD0302248D774E0EBFC4B3E259BB7C3ED6C47BDFD5661CF3E1B37D01D9E95BE2E38B6E1D5F403C1BCBDF34
Malicious:	false
Preview:	Dec 28 12:24:23 galassia systemd-logind[6982]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 12:24:23 galassia systemd-logind[6982]: User enumeration failed: Invalid argument.Dec 28 12:24:23 galassia systemd-logind[6982]: User of session 2 not known..Dec 28 12:24:23 galassia systemd-logind[6982]: Session enumeration failed: No such file or directory.Dec 28 12:24:23 galassia systemd-logind[6982]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 12:24:23 galassia systemd-logind[6982]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 12:24:23 galassia systemd-logind[6982]: New seat seat0..Dec 28 12:24:38 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 12:24:38 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 12:24:38 galassia systemd-logind[6982]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlZGPWt/lBGPWd/:F3Tt/Nd/
MD5:	E02E19B9AAF01CDFA279478060AC2C2F
SHA1:	D74F08FCC07DFC13B1A6DBE75B0C0F9954C37856
SHA-256:	2F81DB43A377D11D535F345DE8D002F0A01480B3C5F623430E1D0A9263166A5D
SHA-512:	33ED4D2121B1BB1428FBD33183CC5FAE04347DC2EC9076B3DA0A2AA1C86529760976421F5662E6814BEA87AC758D6C6C52781080E352592CA337288A792EE8FA
Malicious:	false
Preview:	LPKSHHRH.................X...O.....^..................................X...O.....^.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlqzQ8el0zQ8ul:F3688el088ul
MD5:	7FA23D95975786CB4D1B629361AE8205
SHA1:	7C283BDDA954DDBAC8FC42BD6B5EDAC592314527
SHA-256:	9E2028B50A04D9CD56863CA85DFC6A443FCDD08EA7EED4B6492E6ED41D9C2A94
SHA-512:	9F020CA2E41E2B443CC58E6FEBCAF41D1FD1D7F07DE45AD3541D027D8F6CA7C36BB651B45383E066DDC29E662EAB6826903337D0F5B2E3A23B6116D62228EE18
Malicious:	false
Preview:	LPKSHHRH..................C..7I..uj.)X....................................C..7I..uj.)X..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12393
Entropy (8bit):	4.958191723859168
Encrypted:	false
SSDEEP:	96:emwwuVHgzqTzNjzfFD8CFcKUUY+F86NgZbhHCmPmjwbrYoyj7/mwMmJkGqfa83cJ:NMlZRhSgJr86PY5UISIPVZ7ruTBvv
MD5:	C39E09960FEA23F13066CC8372241799
SHA1:	024DD13EF726FC29BE264857F36289107004B877
SHA-256:	837E4544E0565F262AEA8BB3C8C45C99993F48BCAD2A0D666F747E0B7DCBFC83
SHA-512:	F9B8DC456F09F0386732C050E6831259C0E29860CB4A819B2D24A24D893C907FF2B71A743B9F0CC9B1A0EECA6D52A31C5231EC36B54967C53E98BC3F673B98CE
Malicious:	false
Preview:	Dec 28 12:24:13 galassia kernel: [ 553.813634] blocking signal 9: 6245 -> 2048.Dec 28 12:24:13 galassia kernel: [ 558.561802] blocking signal 9: 6245 -> 658.Dec 28 12:24:13 galassia kernel: [ 558.562883] blocking signal 9: 6245 -> 720.Dec 28 12:24:13 galassia kernel: [ 558.563923] blocking signal 9: 6245 -> 772.Dec 28 12:24:13 galassia kernel: [ 558.566027] blocking signal 9: 6245 -> 936.Dec 28 12:24:13 galassia kernel: [ 558.567100] blocking signal 9: 6245 -> 2048.Dec 28 12:24:13 galassia kernel: [ 559.054585] New task spawned: old: (tgid 7005, tid 7005), new (tgid: 7005, tid: 7045).Dec 28 12:24:13 galassia kernel: [ 559.055625] New task spawned: old: (tgid 7005, tid 7005), new (tgid: 7005, tid: 7046).Dec 28 12:24:14 galassia kernel: [ 559.065822] New task spawned: old: (tgid 7005, tid 7046), new (tgid: 7005, tid: 7047).Dec 28 12:24:14 galassia kernel: [ 559.540582] New task spawned: old: (tgid 7027, tid 7027), new (tgid: 7027, tid: 7050).Dec 28 12:24:15 galassia kernel: [

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30468
Entropy (8bit):	5.113366387532293
Encrypted:	false
SSDEEP:	768:kR78S7hTnR9TnRNwLMAZUg2XZN7tnzp+5c0q+k9ZrRPjZ9+isIH5rzPhox1/G84q:Y78JLT5cHllZtQ
MD5:	6C4D1CE84E33A579FDEAA22259C24FC5
SHA1:	D1F5772FFA3044529C21FFA8EB2432028AD97720
SHA-256:	767CA4F4CE476525D561C3C3D9B25F02981F543084536D4D26899CA7383978AD
SHA-512:	41A2BD24A8BC52C3FE31F4BEA4B327C2CF1830DB38B9A5448B8764F7C38E871400EAFE082FEAC6909628D2DF88A8D9F8475713740AFB0515C4D461FA60141E31
Malicious:	false
Preview:	Dec 28 12:24:13 galassia kernel: [ 553.813634] blocking signal 9: 6245 -> 2048.Dec 28 12:24:13 galassia kernel: [ 558.506541] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 28 12:24:13 galassia kernel: [ 558.506556] systemd[1]: Stopped Journal Service..Dec 28 12:24:13 galassia kernel: [ 558.507763] systemd[1]: Starting Journal Service....Dec 28 12:24:13 galassia kernel: [ 558.511988] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 28 12:24:13 galassia kernel: [ 558.511993] systemd[1]: dbus.service: Failed with result 'signal'..Dec 28 12:24:13 galassia kernel: [ 558.514475] systemd[1]: Started D-Bus System Message Bus..Dec 28 12:24:13 galassia kernel: [ 558.532045] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 28 12:24:13 galassia kernel: [ 558.532124] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 28 12:24:13 galassia kernel: [ 558.532653] s

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:7AsXlXEWtl/5gl:7h+ylS
MD5:	28A24E2AE30639C43EEF0EFC7BF89D54
SHA1:	66720D33A88DF38665A910F00C5A57C1BA49C1E2
SHA-256:	0FB97C60C7F4AD8998951FFC9D38EA169FE594F58A0BDBBF547E3572B7B3F3D4
SHA-512:	A98A3145C4794EAB9164741CF5298D4A6976C56E5D9046BBA3063B65F27CEB097F17AB55D21A5857FADB0D41D6C0736B5F7BEE73B487CE7F178D891A50F7A35C
Malicious:	true
Preview:	....E...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................E...SBpg........................................

Source: gnjqwpc.elf	Virustotal: Detection: 57%			Perma Link
Source: gnjqwpc.elf	ReversingLabs: Detection: 57%

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:53458 -> 178.215.238.153:33966

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.773733836741663
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gnjqwpc.elf
File size:	162'760 bytes
MD5:	12de90cdff8b135be46e841670cbb9e7
SHA1:	c344554da1746c30541cb75f66bbbc95df227415
SHA256:	52d58da3e7dff8f35da1ae6b89bb9a58072a8e6dd3e66161e4ba49dfb2032e30
SHA512:	f721e605fa6d4c3072afe22aafcefc6c9c10ba36bea7b5aed7847906dbce9a226218ba806191a4c5ef1dbcb9443ccd9dd47c1aa45fb926612c90c023a7e382b2
SSDEEP:	1536:opsgR5rLxAXeQWpLnMKPI2oPxY1dOHq84a5HE7L2hjL0F3vAVAekOmBYTUgqI9U/:M3OxCxiPxAXhAE7qh4IVilwspH
TLSH:	50F33A06730C0907D1632EF43A3F67E183EF9AC121E4F645695FAA4A9172E371586ECE
File Content Preview:	.ELF...........................4..y......4. ...(....................../.../...............0...0...0...Il...X........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........zx..../...@..\?.....0D.+../...A..$8...})....0DN..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162240
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1fb10	0x0	0x6	AX	4
.fini	PROGBITS	0x1001fbc8	0x1fbc8	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001fbe8	0x1fbe8	0x33fc	0x0	0x2	A	8
.ctors	PROGBITS	0x10033000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1003300c	0x2300c	0x8	0x0	0x3	WA	4
.got2	PROGBITS	0x10033018	0x23018	0xc	0x0	0x3	WA	1
.data	PROGBITS	0x10033040	0x23040	0x48a0	0x0	0x3	WA	32
.sdata	PROGBITS	0x100378e0	0x278e0	0x8c	0x0	0x3	WA	4
.sbss	NOBITS	0x1003796c	0x2796c	0x108	0x0	0x3	WA	4
.bss	NOBITS	0x10037a78	0x2796c	0x44e0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x2796c	0x51	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x22fe4	0x22fe4	6.2375	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x23000	0x10033000	0x10033000	0x496c	0x8f58	0.4674	0x6	RW	0x10000	.ctors .dtors .got2 .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 19:21:51.025722027 CET	39679	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:21:51.266077042 CET	53	39679	8.8.8.8	192.168.2.23
Dec 28, 2024 19:21:51.267982006 CET	58215	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:21:51.508065939 CET	53	58215	8.8.8.8	192.168.2.23
Dec 28, 2024 19:21:53.041085005 CET	40523	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:21:53.176296949 CET	53	40523	8.8.8.8	192.168.2.23
Dec 28, 2024 19:21:53.177721977 CET	41487	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:21:53.441060066 CET	53	41487	8.8.8.8	192.168.2.23
Dec 28, 2024 19:22:40.100656986 CET	40705	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:22:40.100696087 CET	35028	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:22:40.241867065 CET	53	40705	1.1.1.1	192.168.2.23
Dec 28, 2024 19:22:40.350836992 CET	53	35028	1.1.1.1	192.168.2.23
Dec 28, 2024 19:22:40.696780920 CET	50443	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:22:40.834244967 CET	53	50443	1.1.1.1	192.168.2.23
Dec 28, 2024 19:23:03.032259941 CET	43320	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:23:03.032299995 CET	34673	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:23:03.172441959 CET	53	34673	1.1.1.1	192.168.2.23
Dec 28, 2024 19:23:03.263237000 CET	53	43320	1.1.1.1	192.168.2.23
Dec 28, 2024 19:23:20.262407064 CET	42434	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:23:20.401832104 CET	53	42434	1.1.1.1	192.168.2.23
Dec 28, 2024 19:23:39.335767031 CET	54931	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:39.470182896 CET	53	54931	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:39.472572088 CET	47280	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:39.714914083 CET	53	47280	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:41.150573015 CET	50899	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:41.285022974 CET	53	50899	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:41.286041021 CET	38746	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:41.525569916 CET	53	38746	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:42.959028959 CET	56062	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:43.199134111 CET	53	56062	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:43.199938059 CET	60474	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:43.337754965 CET	53	60474	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:44.774885893 CET	41396	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:44.908835888 CET	53	41396	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:44.909763098 CET	39457	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:45.044307947 CET	53	39457	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:46.476124048 CET	45569	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:46.715580940 CET	53	45569	8.8.8.8	192.168.2.23
Dec 28, 2024 19:23:46.716393948 CET	46366	53	192.168.2.23	8.8.8.8
Dec 28, 2024 19:23:46.850927114 CET	53	46366	8.8.8.8	192.168.2.23
Dec 28, 2024 19:24:17.835139990 CET	37576	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:24:17.835232019 CET	39899	53	192.168.2.23	1.1.1.1
Dec 28, 2024 19:24:17.973715067 CET	53	39899	1.1.1.1	192.168.2.23
Dec 28, 2024 19:24:18.074155092 CET	53	37576	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 19:22:40.850841999 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 19:24:00.861008883 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-28 18:22:45 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 18:22:45 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 18:22:45 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 18:22:46 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 18:22:46 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:21:50
Start date (UTC):	28/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	/tmp/gnjqwpc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:21:52
Start date (UTC):	28/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:23:19
Start date (UTC):	28/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	18:21:51
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:32
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:34
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:37
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:38
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:39
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:40
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:41
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gnjqwpc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6646/oom_score_adj

/proc/6958/oom_score_adj

/proc/7117/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1027263XncdzM

/run/systemd/journal/streams/.#9:1027264IGgliL

/run/systemd/journal/streams/.#9:1027265mAZPtN

/run/systemd/journal/streams/.#9:1027274pv1hSM

/run/systemd/journal/streams/.#9:1027275Y5270K

/run/systemd/journal/streams/.#9:10655806rWAPN

/run/systemd/journal/streams/.#9:23593407qZQrL

/run/systemd/journal/streams/.#9:2359403jMSEAL

/run/systemd/journal/streams/.#9:2359405HFXhtJ

/run/systemd/journal/streams/.#9:2359548vvPsfN

/run/systemd/journal/streams/.#9:2359561S9LjgM

/run/systemd/journal/streams/.#9:2359563dfKLPN

/run/systemd/journal/streams/.#9:2359746WHpFpJ

/run/systemd/journal/streams/.#9:2359795ymW0AM

/run/systemd/journal/streams/.#9:2359937bCX9sM

/run/systemd/journal/streams/.#9:596789B97BzL

/run/systemd/journal/streams/.#9:596790L4uKTL

Linux Analysis Report
gnjqwpc.elf

Start time (UTC):	18:22:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:22:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:22:44
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:45
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:55
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:22:57
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:22:58
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	18:22:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	18:22:56
Start date (UTC):	28/12/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	18:23:00
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75