Edit tour

Linux Analysis Report
fnkea7.elf

Overview

General Information

Sample name:	fnkea7.elf
Analysis ID:	1581717
MD5:	9459f8d509e4be4d841e2a9d29aae54e
SHA1:	3db5f9abc13b59ee3291704259feac81238c0ec6
SHA256:	635589bbf5d0b0a3b1fc77ab35087010897be88b7b7cce68b952663a2f929768
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581717
Start date and time:	2024-12-28 20:21:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fnkea7.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/118@162/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/fnkea7.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

fnkea7.elf (PID: 6236, Parent: 6158, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fnkea7.elf

fnkea7.elf New Fork (PID: 6238, Parent: 6236)

fnkea7.elf New Fork (PID: 6240, Parent: 6238)

fnkea7.elf New Fork (PID: 6242, Parent: 6240)

sh (PID: 6242, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6248, Parent: 6242)

ps (PID: 6248, Parent: 6242, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6483, Parent: 6240)

sh (PID: 6483, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6487, Parent: 6483)

ps (PID: 6487, Parent: 6483, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6598, Parent: 6240)

sh (PID: 6598, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6600, Parent: 6598)

ps (PID: 6600, Parent: 6598, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

systemd New Fork (PID: 6288, Parent: 1)

journalctl (PID: 6288, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6304, Parent: 1)

systemd-journald (PID: 6304, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6308, Parent: 1)

journalctl (PID: 6308, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6316, Parent: 1)

dbus-daemon (PID: 6316, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6327, Parent: 1320)

Default (PID: 6327, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6330, Parent: 1860)

pulseaudio (PID: 6330, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 6331, Parent: 1320)

Default (PID: 6331, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6332, Parent: 1320)

Default (PID: 6332, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6334, Parent: 1)

rsyslogd (PID: 6334, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6336, Parent: 1)

rtkit-daemon (PID: 6336, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6339, Parent: 1)

systemd-logind (PID: 6339, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6404, Parent: 1)

polkitd (PID: 6404, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6408, Parent: 1)

gpu-manager (PID: 6408, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6412, Parent: 6408)

sh (PID: 6412, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6412)

grep (PID: 6413, Parent: 6412, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6415, Parent: 6408)

sh (PID: 6415, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6416, Parent: 6415)

grep (PID: 6416, Parent: 6415, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6417, Parent: 6408)

sh (PID: 6417, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6419, Parent: 6408)

sh (PID: 6419, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6420, Parent: 6419)

grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6421, Parent: 6408)

sh (PID: 6421, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6423, Parent: 6408)

sh (PID: 6423, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6424, Parent: 6423)

grep (PID: 6424, Parent: 6423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6425, Parent: 6408)

sh (PID: 6425, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6427, Parent: 6408)

sh (PID: 6427, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6414, Parent: 1)

agetty (PID: 6414, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6431, Parent: 1)

generate-config (PID: 6431, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6432, Parent: 6431)

pkill (PID: 6432, Parent: 6431, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6435, Parent: 1)

gdm-wait-for-drm (PID: 6435, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 6437, Parent: 2038)

fusermount (PID: 6437, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6445, Parent: 1)

gdm3 (PID: 6445, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6450, Parent: 6445)

plymouth (PID: 6450, Parent: 6445, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6467, Parent: 6445)

gdm-session-worker (PID: 6467, Parent: 6445, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6471, Parent: 6467)

gdm-wayland-session (PID: 6471, Parent: 6467, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6473, Parent: 6471)

dbus-daemon (PID: 6473, Parent: 6471, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6475, Parent: 6473)

dbus-daemon New Fork (PID: 6476, Parent: 6475)

false (PID: 6476, Parent: 6475, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6477, Parent: 6471)

dbus-run-session (PID: 6477, Parent: 6471, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6478, Parent: 6477)

dbus-daemon (PID: 6478, Parent: 6477, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6479, Parent: 6445)

Default (PID: 6479, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6480, Parent: 6445)

Default (PID: 6480, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6451, Parent: 1)

accounts-daemon (PID: 6451, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6462, Parent: 6451)

language-validate (PID: 6462, Parent: 6451, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6463, Parent: 6462)

language-options (PID: 6463, Parent: 6462, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6464, Parent: 6463)

sh (PID: 6464, Parent: 6463, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6465, Parent: 6464)

locale (PID: 6465, Parent: 6464, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6466, Parent: 6464)

grep (PID: 6466, Parent: 6464, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6512, Parent: 1)

journalctl (PID: 6512, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6513, Parent: 1)

systemd-journald (PID: 6513, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6514, Parent: 1)

dbus-daemon (PID: 6514, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6517, Parent: 1)

rsyslogd (PID: 6517, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6521, Parent: 1)

systemd-logind (PID: 6521, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6579, Parent: 1)

agetty (PID: 6579, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6583, Parent: 1)

gpu-manager (PID: 6583, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6584, Parent: 6583)

sh (PID: 6584, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6585, Parent: 6584)

grep (PID: 6585, Parent: 6584, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6586, Parent: 6583)

sh (PID: 6586, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6588, Parent: 6583)

sh (PID: 6588, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6592, Parent: 6583)

sh (PID: 6592, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6594, Parent: 6583)

sh (PID: 6594, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6595, Parent: 6594)

grep (PID: 6595, Parent: 6594, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6596, Parent: 6583)

sh (PID: 6596, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6597, Parent: 6596)

grep (PID: 6597, Parent: 6596, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6601, Parent: 6583)

sh (PID: 6601, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6602, Parent: 6601)

grep (PID: 6602, Parent: 6601, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6603, Parent: 6583)

sh (PID: 6603, Parent: 6583, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6604, Parent: 6603)

grep (PID: 6604, Parent: 6603, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6605, Parent: 1)

journalctl (PID: 6605, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6606, Parent: 1)

generate-config (PID: 6606, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6607, Parent: 6606)

pkill (PID: 6607, Parent: 6606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6611, Parent: 1)

gdm-wait-for-drm (PID: 6611, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6614, Parent: 1)

journalctl (PID: 6614, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6615, Parent: 1)

dbus-daemon (PID: 6615, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6616, Parent: 1)

agetty (PID: 6616, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6619, Parent: 1)

systemd-logind (PID: 6619, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6676, Parent: 1)

rsyslogd (PID: 6676, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6678, Parent: 1)

systemd-journald (PID: 6678, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6688, Parent: 1)

gdm3 (PID: 6688, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6691, Parent: 6688)

plymouth (PID: 6691, Parent: 6688, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6715, Parent: 6688)

gdm-session-worker (PID: 6715, Parent: 6688, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6723, Parent: 6715)

gdm-wayland-session (PID: 6723, Parent: 6715, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6727, Parent: 6723)

dbus-daemon (PID: 6727, Parent: 6723, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6731, Parent: 6727)

dbus-daemon New Fork (PID: 6732, Parent: 6731)

false (PID: 6732, Parent: 6731, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6733, Parent: 6723)

dbus-run-session (PID: 6733, Parent: 6723, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6734, Parent: 6733)

dbus-daemon (PID: 6734, Parent: 6733, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6736, Parent: 6688)

Default (PID: 6736, Parent: 6688, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6737, Parent: 6688)

Default (PID: 6737, Parent: 6688, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6692, Parent: 1)

accounts-daemon (PID: 6692, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6696, Parent: 6692)

language-validate (PID: 6696, Parent: 6692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6697, Parent: 6696)

language-options (PID: 6697, Parent: 6696, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6698, Parent: 6697)

sh (PID: 6698, Parent: 6697, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6699, Parent: 6698)

locale (PID: 6699, Parent: 6698, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6700, Parent: 6698)

grep (PID: 6700, Parent: 6698, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6702, Parent: 1860)

dbus-daemon (PID: 6702, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6703, Parent: 1)

journalctl (PID: 6703, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6704, Parent: 1860)

pulseaudio (PID: 6704, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6708, Parent: 1)

polkitd (PID: 6708, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6712, Parent: 1)

rtkit-daemon (PID: 6712, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6721, Parent: 1)

systemd (PID: 6721, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6728, Parent: 6721)

systemd New Fork (PID: 6729, Parent: 6728)

30-systemd-environment-d-generator (PID: 6729, Parent: 6728, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6738, Parent: 6721)

systemctl (PID: 6738, Parent: 6721, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6739, Parent: 6721)

pulseaudio (PID: 6739, Parent: 6721, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6744, Parent: 6721)

dbus-daemon (PID: 6744, Parent: 6721, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fnkea7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
fnkea7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6236.1.00007fb454017000.00007fb454038000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.00007fb454017000.00007fb454038000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: fnkea7.elf PID: 6236	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: fnkea7.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3dda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ea2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ede:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ef2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6334)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6517)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6676)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6304)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6445)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6473)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6678)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6688)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6727)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6734)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6721)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.38.dr, syslog.137.dr, syslog.195.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38374
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007fb454017000.00007fb454038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 840, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4507, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6329, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6336, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6339, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6445, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6451, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6483, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6487, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6514, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6515, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6521, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6579, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6598, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6600, result: no such process	Jump to behavior

Source: fnkea7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/maps[killer/maps] killed process: %s ;; pid: %d

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4507, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6329, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6336, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6339, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6445, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6451, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6483, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6487, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6514, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6515, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6521, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6579, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6598, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6600, result: no such process	Jump to behavior

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007fb454017000.00007fb454038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/118@162/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6316)	File: /proc/6316/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6437)	File: /proc/6437/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6473)	File: /proc/6473/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6514)	File: /proc/6514/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6615)	File: /proc/6615/mounts
Source: /usr/bin/dbus-daemon (PID: 6727)	File: /proc/6727/mounts
Source: /usr/bin/dbus-daemon (PID: 6734)	File: /proc/6734/mounts
Source: /usr/bin/dbus-daemon (PID: 6702)	File: /proc/6702/mounts
Source: /usr/bin/dbus-daemon (PID: 6744)	File: /proc/6744/mounts

Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:76162ssfrWQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:76168VGT1GT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:755731VV9RQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:75614zpWw9R	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:75623w4d5YR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:75631VSHWDS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:75634WlR0KU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:767678v9LQT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:76775NdlbSQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:77916n0NFhU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:779820rz8qR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78036Z3qm9T	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:781289vcgFR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78137GD4mYR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78161g4vZQS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78265NKufRU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78287GV003T	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78288vELVJQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78301FWOqPU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	File: /run/systemd/journal/streams/.#9:78302uzD4eT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/seats/.#seat0bls9Du	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/users/.#127UaR9Eu	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/users/.#127509tMu	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/seats/.#seat0yqPVgv	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/users/.#127NeJSBv	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/users/.#127FJ9GTw	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6339)	File: /run/systemd/users/.#127JAOgCw	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6404)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6471)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78489RDZnzG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78490Bi1d8G	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:784986428vF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78513x4c5QF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78516sqYt7G	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78526iFODoF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:78527tln04H	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	File: /run/systemd/journal/streams/.#9:80154QrFzMF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6521)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6521)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6521)	File: /run/systemd/seats/.#seat08Sw3Vi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6619)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6619)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/seats/.#seat0t2bYBG
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#1273Fn1nG
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#127Uovd9G
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/seats/.#seat0ygOyyH
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#127MjLiLH
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#127NwidhJ
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#127lq0ZrJ
Source: /lib/systemd/systemd-logind (PID: 6619)	File: /run/systemd/users/.#127hEIy2E
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:589494k878x9
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:601112abpfV7
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:6021670LgnU7
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:704423TePUS7
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:704431967K3b
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:721151rkwGt9
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:731485yytK7a
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:731997c592xa
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:731998DTe0q8
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:732004NaaQ87
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:732011sEJMH8
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:732020CYmFJa
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:732065R0HZv8
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:7320672fEJy9
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:1080403ElV619
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:1080416pn7Czb
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:1080418KfPjsb
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:1080602yJOqT9
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:10806506kuti8
Source: /lib/systemd/systemd-journald (PID: 6678)	File: /run/systemd/journal/streams/.#9:1080792iGUdR7
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6723)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6692)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6692)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6708)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6721)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6729)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/249/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/249/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6238/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	File opened: /proc/9/cmdline	Jump to behavior

Source: /tmp/fnkea7.elf (PID: 6242)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6483)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6598)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6412)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6423)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6464)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6584)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6594)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6596)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6601)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6603)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6698)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6416)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6466)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6585)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6595)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6597)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6602)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6604)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6700)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6432)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6607)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6248)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6487)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6600)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior

Source: /lib/systemd/systemd (PID: 6738)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6248)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6487)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6600)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6678)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6414)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6579)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6616)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6445)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6445)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6688)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6688)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6692)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6692)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6334)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6334)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6408)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6517)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6517)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6583)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6676)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6676)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fnkea7.elf (PID: 6238)

File: /tmp/fnkea7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6408)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Source: /usr/bin/ps (PID: 6248)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6600)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6330)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6607)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6704)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6739)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/fnkea7.elf (PID: 6236)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6304)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6330)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6334)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6414)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6467)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6513)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6517)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6579)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6616)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6676)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6678)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6715)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6704)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6739)	Queries kernel information via 'uname':

Source: syslog.195.dr	Binary or memory string: Dec 28 13:24:31 galassia kernel: [ 572.903633] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.38.dr	Binary or memory string: Dec 28 13:23:05 galassia kernel: [ 486.483257] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: fnkea7.elf, 6236.1.00007fffbf47a000.00007fffbf49b000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.wqoWjI
Source: fnkea7.elf, 6236.1.00007fffbf47a000.00007fffbf49b000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.wqoWjI:
Source: fnkea7.elf, 6236.1.000055b2cf44a000.000055b2cf59c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: fnkea7.elf, 6236.1.00007fffbf47a000.00007fffbf49b000.rw-.sdmp	Binary or memory string: %x86_64/usr/bin/qemu-arm/tmp/fnkea7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fnkea7.elf
Source: syslog.195.dr	Binary or memory string: Dec 28 13:24:31 galassia kernel: [ 572.903612] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.38.dr	Binary or memory string: Dec 28 13:23:05 galassia kernel: [ 486.483340] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: fnkea7.elf, 6236.1.000055b2cf44a000.000055b2cf59c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: fnkea7.elf, 6236.1.00007fffbf47a000.00007fffbf49b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6692)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007fb454017000.00007fb454038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007fb454017000.00007fb454038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fnkea7.elf	53%	ReversingLabs	Linux.Backdoor.Mirai
fnkea7.elf	54%	Virustotal		Browse
fnkea7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.153	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.38.dr, syslog.137.dr, syslog.195.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
raw.cardiacpure.ru	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
raw.cardiacpure.ru	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.215.238.69
CANONICAL-ASGB	nshkarm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	nshkarm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	nshkmips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mips.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	nshkarm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	nshkmips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wlw68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	woega6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6476/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6732/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:/n:/
MD5:	9536A45B656483B4A5B5402E6F751CB4
SHA1:	1252372C2469BB62B104575F5500A95FD7FFA830
SHA-256:	3A809B509A3E89134AE2CF02E5C9E5C415173538756064E23F9ED1BC36F8AF36
SHA-512:	DAC1BE28B8B8B52F053000C6759BFD98C16BD06CBAD47EB43C5008C48C4B07CF7F50A688B37257748CFB24343E33DEDD4F39ACEDCE2E173600D53A7BFE87D90F
Malicious:	false
Preview:	6688.

/run/systemd/journal/streams/.#9:1080403ElV619

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.400441590299567
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/Qq/RdrRWrGs2lsje:SbFuFyLVIg1BG+f+MIaXRjsZjZcHBrt
MD5:	BD90C2963291869645A77392FDF1F745
SHA1:	4C560145F50476EFA298994543378645BF1E9C0B
SHA-256:	E0EE4CC5780AB67E8B449928F8975DB782CBD4E3557743FAF89D2047736DE75C
SHA-512:	C36878E85717CBA0B40AD19264042B316C29FEE365632686823F8B0980E9243F11EE390C18FE77389FEEA3E4A64EC8525F8DBAD33E08748E687869E5F307AE69
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=532a7dc4f8004fd695443450111e3eea.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:1080416pn7Czb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.519274994282777
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MOnQXp3MF2jFQMzKaBu:qgFqo6g7/+0+f+MbZ3MFETmh
MD5:	E0C90558DDB9CA821EDF3827C27F18A7
SHA1:	396F6AF980CB03D990E7FD061FD2D8A32DAD3348
SHA-256:	5046D58B6C055EEE03FCDCF8EEF5A695D33195DDEF10583F5384CCDA26BEA113
SHA-512:	789B9A6FD784E8E40922BDF148053C491EB5546081F1FC1EE377F2D4FEC2A411071AF129493703A9F84B5805FD7C0AE242F61A15687D20D2A6064A494CA00209
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5ec67651050452b95cf3395ba9bcf2e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1080418KfPjsb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.508600827996176
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsmRutF2jFQMzKaBu:qgFqdg7/+0+f+MsmcETmh
MD5:	3C13776E912C408D2A477F8FBC2912A1
SHA1:	4422BB424C8B82542A68A545372F1FB66ABCA013
SHA-256:	5C7371945C364FC4492B63C0BD8B5465E08D20B75BA1E429263C750BDCC9084D
SHA-512:	48E1A06330F9B993CC921DA638E97F6AB91DCD3688127EC85A8BBBADDA9778F906C07107D151BB287324361D09C660659AB3A321B7038B6B553D094B909B291F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f3c0f4efbc35470098c955c7a033e868.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1080602yJOqT9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.357097366859192
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsAgUW1XSfWWdXTjsb:SbFuFyLVIg1BG+f+Ms/daZTjZcHjv
MD5:	5B1EB2449BF52DBFAF567E17AB7E9364
SHA1:	CE44EFAE42C772C3678B51B106EA54E9CEA535BD
SHA-256:	5D3AC3B9A00D4505EECA19AF06E4998462E74BFCAE41F60727F168B30D25E508
SHA-512:	A9AE8783958B440F62D854C911B28D264C57EE42671B8B6ECC6150D1A41E93F295F4AFE59393B5E72A20F62FC64B5D04F1E8780347A44897DB61715DF9E5706F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe4c13dc5ca3457ab5334fded8fe7d26.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:10806506kuti8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.296942189529627
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6BBhQBNilDaXGrR//:SbFuFyLVIg1BG+f+M63hQBNilwatZjtT
MD5:	784438A30D3457E1768A4DD44F6C7493
SHA1:	BF8B3635A0B9C809C90508EAF61B20B5EC59031D
SHA-256:	F636A8A1309895C9C1DD77AF201F72A7DD19D361CBE73ECB3680B917F142A5FC
SHA-512:	290E59CCA93839411C4D06F869FBDC943E6DF1E0E040994AC494AC682ED506D2520AB3AA217D51AEAE2A3403B563BE8A964585A7BBE351E92C78D75D7E050131
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c3dea5df01c4a88854cfe9a2cd833ad.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:1080792iGUdR7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.358991181377043
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5nTk2SlWwhr1UHVYJ:SbFuFyLVIg1BG+f+MV8CHX2joa
MD5:	1F865AF99C390285D43C76D6AB55AAE4
SHA1:	F9B24CB2F7E88A03FE7960557637B1FBA224B33C
SHA-256:	305F97B0325E84691AB875AFF58FB1C5BE9374B7CFC0ECFFECEF16E971610F42
SHA-512:	E580D8E758986997AD0D6E907A09ECE58E80BBE06EBD29B311199E8415E8533930C6FA918C58AC6F3F759F1B3538D3E938EF0CC1B31F40AABC22DAB427E38935
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=36536bae6717439dbea70508fb0221b0.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:589494k878x9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.515273941145835
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/EQyHYTRdzTjs7Lbr:SbFuFyLVIg1BG+f+MMh+ji4s
MD5:	892216E5E7CB5A1FC671FB99B46C440A
SHA1:	3CDF6433E48F8553289C75CF06AEA280EF32CC53
SHA-256:	59B4AC668BFCE7179F46084EEAD6C998D91354D79E140C2ABD17EE8131B3CAEE
SHA-512:	ADEE99186D773B6605D5E023B48E69B9A58E2BF2833E153D82FD610ECC481F2B394707468F2D1BA50FC1A87A7402F3214531DD517215ED48A73AA92E6A33AB5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=53d6aad82e734b7b9aa0a31941e4810f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:601112abpfV7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3832058584422215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpSDSsA4vXsjs1Had9:SbFuFyLVIg1BG+f+M0DDA40josQu
MD5:	EFE4966155D027033A8D854904A442CB
SHA1:	7D90595DABED72173C3D8A9D6A78E39400176433
SHA-256:	5351943F2D5F9E40DD793FE20B437F488C68F5E5C63A4C56EB3A8C0909A1B1B4
SHA-512:	120437095AA928EFB5D4AA8D19BBA36277E72F9985FECE5232AF1D06FF3F2DCEB9C4D55833306F639F1B9FBDCBD63D5A9F34A4557E3FD7D3A7DFB493A6233E91
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c12d30a607a74ebfbaae8bc13e9074a2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:6021670LgnU7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.454462407464522
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyokiSA6ZjZcHcljX+:qgFq6g10+f+MulA6zmAu
MD5:	E1C6BF388B1E897C342F2BC0AEE2BE27
SHA1:	3BAD4D2EBF836E4C074280B75C7CEBA1EF9805F9
SHA-256:	8AD0D6C61DCE0C9B0911FD829CE23DAA7049987C4628999D3A707563C08A7127
SHA-512:	4F84D1E584855947BDA9D1639E0B638300140311417B51DD3E01879DC08E93B863E7FB473847D7BD46DF4CF46210A6D8B666162167F3D68BBF407DAE633C9C9B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c7ef7cdaff74e6e85af2cec268a5be0.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:704423TePUS7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.395648746415845
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mo6nXZHRMqjdCLKzK:qgFq6g10+f+MXn/MgCLAK
MD5:	7FF39178E3A7FC71F00F96039842548C
SHA1:	AAC61048FA5646AC375324AC8541B85235477226
SHA-256:	720ACD4F2C7CE0FEEBBC728C45EAE75500150EF314B43707BEE118D59AEF751F
SHA-512:	22FE6CD4F752074A39A61EDC40D461CDEC0939FD4159E5948A5E7861DE5E0EE0C2C7C4D060862963C996D55A1E535FC78A25B38170237046E8428BB62D3E2DAB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16290d15162d42288c263bbb0b421b75.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:704431967K3b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.391562652524755
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7PUDH0qshTjs2BZZGu:SbFuFyLVIg1BAf+MjzqsZjNTZD
MD5:	68A6F8D07315FA681AF1957EE56CBCAD
SHA1:	0E4A9988F9DEFCCC813FCB3FAF66664797FAD2C2
SHA-256:	CD9BCACE36B960386C60D12720917F8D8B8097838E3D4AD781CE79AF9D13AC48
SHA-512:	5CFCE15377017B4DF528D54BAD398F3171A53BC8EC548679AC44FE740B194EB90F4C85EFBFE3865C6C598D9602C2BEB78A7EEAF5C51C73356AF375F62847CE23
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=112244e3efaa42818db2080d616b5d57.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:721151rkwGt9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.449488866311437
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmulCrWWVrqjswxJBpK:SbFuFyLVIg1BG+f+Mul+bV2jLTTIWTIL
MD5:	72FE614A291F637F6FA58FA4EC893448
SHA1:	377AC0AB81D33D76E83501B42AA79DE64E2877D8
SHA-256:	569B910A46481058003A25DB21342D7B80DCB581404C65E735CB2475F3A641A5
SHA-512:	3CE21501513B9BD4E9999499AE5A04342457C4FCA77F2E7249CC4221003892868C6DAC67685ECF5EBC2F3DFCFEB794EBF474DD930EABC7EFD4131D82286323D8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd2fcc079b3e4cb5a6848c007785116f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:731485yytK7a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.411049075828684
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrJ2ZQT0la0jswkClK:SbFuFyLVIg1BG+f+M8i0lfjLkGq
MD5:	314F410DABD2D3D2B8F6B34A55A9402A
SHA1:	2A41C5179CA61A46549F94A919E043227BD57839
SHA-256:	0F152E16C9940A22EB39C3A1BDCEB6F664F6A7D1CC1DB86CF021B72F3983EEFB
SHA-512:	D1A006D803446EFBEA181FDCAD8D2C0B823022B1C26F0B8E8F78FC3A478F554BA28D0596CD7C49928E662B648F299AECAD985F1450A8609A5298372BA5C7C37A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ae9f2b47c4a0479d8784e45d036e1db9.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:731997c592xa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3774392629538825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8CdFYBnxc1VNjIQ+J:SbFuFyLVIg1BG+f+M8CdwkVpIhjoa
MD5:	8FDD048EBF7083DF9010FFC1735F9F2D
SHA1:	CB2979CBD6773227C67817944802F7E41AD02845
SHA-256:	6C249A874EE8DBABE7AB2AA2EF66FC3753073FDF3AB43345058FA2083D99D07E
SHA-512:	5334C30B6C9E75C1F94F1EBC4403B7C1FD1B694E9BF10C191BF0C660E2F957788523932C3A6A1FB593CDEB0598FDAD0E3F3A88BFE6343BE72E3465F02D61B35C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=629f855fa5144243a9a9028bfd3be158.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:731998DTe0q8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5147041579064915
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6aU0g0pVTLvshuqjq:SbFuFyLVIg1BG+f+M6anx5qji4s
MD5:	2A2DBACF9EB90C351EF78037B5785204
SHA1:	402738A5D82B84B985BED8E7C05744B17604868B
SHA-256:	EF8082DE983321F3730B6AC423227BD66D04A05043037A7AA2DB4C34D329B0F4
SHA-512:	7AC5183B6D3A7824E5CB299D10ACAD64779D1F52C5A03060FF5F5B3D565ED7B2EBF7B0EA564E56D10E0FB9BE7AAAB7C4773BF941023E7B36D86F2AF75DE6F0F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08b62a15ab0945b698ed96b3a2e506c9.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:732004NaaQ87

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.365801317654665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpvJ3AQ7FRC2YTjshQ:SbFuFyLVIg1BG+f+MxJ3tFRC2YTjtWL0
MD5:	021E970D41DF009DFD19D6BE8CB9CF73
SHA1:	4B0C4DC9980960BE857C24ED45522C62F7E0A0C7
SHA-256:	56702A071F469B0D7A2A72669DA7BACFA0FD55B7BF0AFF87FD8D9E4713323C7F
SHA-512:	DD91D06EA137F5DBA8C6F89C245DCB6D06D3AB7FC82E323BE4271C7C7653A7527DA0987A895A0582A262C3DDA7D458799D6E720B267E4346EB5FCC12FE160BAF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5858bbf10134113a7e556678b4285de.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:732011sEJMH8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.400774716212669
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr0OCITjEDBwlsZjs1:SbFuFyLVIg1BG+f+MoGTjEDBXjbVC
MD5:	79739528DE4D389ED99ACD035785E2E7
SHA1:	EA338C456D659A1D08D9532D6FA4B4D797C16A7A
SHA-256:	F550E5BEB85F7EE502B574F6F3D425BADA29DD499BF30D6F163DF650EAB82462
SHA-512:	4179F03F4805734CCE91AE7E1F04BE708970A5B360284F9F93DB8B1DC82930D8C9E362FE7692732F9469E01CA88F5C292AA10463FFF3B8246B193DAB0C71D34F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4736d238a0248c586118c9afd43a009.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:732020CYmFJa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.39906630777499
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6kcUAURTYDGdQA1GJ:SbFuFyLVIg1BG+f+M6kcUx1VV42jNE
MD5:	FD4ED46B75E3BDF3FCC42104BE506680
SHA1:	1368B51EABC406A97E2FA93B1B9B8D5949BAAB9F
SHA-256:	7D2E988BA8E60F0D36163786E9C184EDB1771073C0601A6589CACBE60D7432F9
SHA-512:	43A922B3DF51A675910816C972295C23A52C75BCE59D63F5C484857949AFBD962122B53D6BD5FA5A5603DD8631BE9125CF2EBBF7FB46B48C287C99CD1AA6C297
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0909d8ee1463467e9abf3d346a5e668a.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:732065R0HZv8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.442126447301911
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/Sz3GcAH7ovsMqQ:SbFuFyLVK6g7/+BG+f+M6zOo0jNq
MD5:	5B4F143D970C929F7AD0E8D614A5E462
SHA1:	3560A6CE41F60040E11D7B3F2FAE7D8E782B0F47
SHA-256:	075E6FEE5C74F41BD4358A2C504DB7C4FD928C602BD87017A98694A0A2232BC2
SHA-512:	E56683DE46778CE8DD7DD4377DF249FA11079A37D05E1FF3DB6FBBAE8D2FAECB19F6A634806A4AC856B0113EB7FA457DC3DEF371A359FD9E780C25F907246E95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5fca51fe12c64b2c9eba4b72e3087044.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:7320672fEJy9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4190996524523065
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4W3XTRH/B2jNq:qgFqdg7/+0+f+M4W3NHZMq
MD5:	F86804274649184A7D03C877E33A14DF
SHA1:	3D23592CA35724B63BAE5C019D71F6D28224DAEB
SHA-256:	3A7B23D6C24AF8035459DF0CE6E760A23A94479E48D1D5DB2CD7EFF9EA65AC4B
SHA-512:	5C8417C5B7CCDB17FEBD2CD5560B0E682141ECECA86EE66703C3ECFCB3E181466D8B85650411CC2C7BCFA76E6168FE4CB8FE3D1078F4E02EA019B709338481F2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2133cc46ff3342649f1ce723b9e33bbb.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:755731VV9RQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.375585324465139
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGnxLRDGQcWVHB3Dd:SbFuFyLVIg1BG+f+MokcWD7josQu
MD5:	354CFA28605AA41C2E061E24F02A7852
SHA1:	EF22A87295633FF9F19FD5C112A51E35FCFA70AC
SHA-256:	273524FBB890BC852DD392FB96BEA678C4AE8A52A17E78BF746111E8A761B003
SHA-512:	67413298AA1A77437CDB03A089E7714F0C68A00CB0502AFA87813B2C15E438961779DF7B278528D11AF53158D1D16771875BE9C1C13D71D68791DC0148E10596
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bcc34e1384d54fc5930bd08fa3df80a0.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75614zpWw9R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.4473945624942335
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4sQ8gEWjFmzXvn:qgFqo6g7/+0+f+M4sHgFQXvn
MD5:	37593F0DE79669AFDEB3D0C1C7C3A1AF
SHA1:	5A63338F1D47B82B78187786497D0B0267EB5BE0
SHA-256:	E30C73B05ABF83DE489F5B4734F4B05DE548BE913DB4DADC2C23F84B8BCD69A2
SHA-512:	C8A3B85CB1E95D71112953C3245ABCFFF0273CEEF9B0BA6783251AE8CAACA74A2156B5C6592845DD147B3A4729BEB133967AA308FE74B769FB910F7A08BA6FC3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e35cd495ba447f39e9e20ecd783f431.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:75623w4d5YR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.400844342173698
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6H2T9VjFmzXvn:qgFqdg7/+0+f+M6HULQXvn
MD5:	55D068D01CA04CFF5A3235B34DC9A5D0
SHA1:	A2520BBDE2D5B47D91C0283E5A890CEA6B6A37E9
SHA-256:	499B6C83C83F1BEE72217DFC4C13C64AF74EEAA358A30A5184DCEA7DC9E00257
SHA-512:	0FF27FDA6CDAA49D141FD1CF2E50717BDD7444DF853DD32ECE7B59A35CA00F51F3AAA258E436935B393E31B832C6640E82AB7EB3DAFECB8B99429496DE215700
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c91fce3cd3ee49359c3009b7457ecc72.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:75631VSHWDS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.416430881015046
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MEUdczAOH0ZjdCLKzK:qgFq6g10+f+M7EmCLAK
MD5:	2F9C96AC3B03AB690675B868394BC6B9
SHA1:	3C229D1E68C64BEACDA21208A6BD476F0171B07F
SHA-256:	256105A66FB4B777C4814C103C3CCDE389193098F3191826F1B5A2B96E17C09F
SHA-512:	D693ED2DA8A2FCEAAD2A8D2F6492F1DDA6DBBCE566F69963029753A38C1E890C1A3D31A343C024F320F4647A6A149C2A5FA5D349CF9D296C802F0CEC16FC1A83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3d6439cf79342a6a4129576c214a87b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75634WlR0KU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.345178727529207
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/gox2VnmwK2TkjshQ:SbFuFyLVIg1BG+f+MIthkjtWL0
MD5:	E28D9DA0B8E5ACD421F91C1556BB9BAF
SHA1:	96FB0C1D0601DF2DAE16DC77BF74BE35A2EC501B
SHA-256:	CCBE66331BF8A9321BE9E19EB7709B51BE67C963FC931844C96E13BA59B7A2F3
SHA-512:	DD37AE5CECB97E7D83D8313D5B6488C3B37ABFCA33AB9D75283FC8878B247DED82F7942F3307757319E0FA65FB85E18542A3A2EB514FFECC31AA74D90255BFC6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=594edc59e98245e39f09d4316456e735.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76162ssfrWQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.528257045670226
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpR3SVREcXGGboZjsv:SbFuFyLVIg1BG+f+MLSVREpGUji4s
MD5:	BEF8AC113EF4B28D4B5482F0A958DF32
SHA1:	6C57A57E7370832092D2AA90A4155458BE0426AA
SHA-256:	A5A7390EE7D6EEC1A64832924D61BFF92CC348841526CAFEAC79B2075418CDE2
SHA-512:	2B1091FC4388E75F927536264E7219145F4E9D2E0E3294177CC9B14ABC8822750ECB50EA2EBDB7F8F6EF416CD192E7BF96D9AA969B49A1D1E3496A5A14643CB6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c396d230a7024b2a996e168acc45740d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76168VGT1GT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.528620023236477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7bBshRnH1a5RR0Zjq:SbFuFyLVIg1BG+f+MfBs18RR0Zji4s
MD5:	DD3AF74CADFDD05EBE3FFAC6C73C7849
SHA1:	94046F8ADD1A32E0858D185F981A3BD88249EA54
SHA-256:	23CBC6EB4FD54C71E89131F17AD0D978AA7456D421AB9B558AF7AD5218A72A56
SHA-512:	407CE65C134D59B5FCDC5A76DA16368838505298F6AFDB5A99417A362AFF49B817A5945737EDC2FC29D08AF8B2AC688A6389057D2E5F2E3561E7D853AB6E5B81
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c3567d98bd44d3ea970a67f1b74e8ef.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:767678v9LQT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.447318851602508
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo3BzVpjXi8jsjOdlE:SbFuFyLVIg1BG+f+MoRzzXi8jNE
MD5:	05530CD1C60C66BEEFC95C69E898ACD0
SHA1:	89D432E82E69328D7BD6937F9252CE67A4FAD944
SHA-256:	27322B8FEC952D8134A6E10C1171AF108E546D0EE615945A638F2E2804A6F389
SHA-512:	355373FCAF9CC83E894546912899E7A0341D31E746B57E416B880787D9C37590B8EE07AB346AEACB22B8951FEB9A576E4C40EFE676AC792780F75CF1B96DB2E6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b92207355219414082475565f2434e45.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76775NdlbSQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.449354729446808
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6w7fy2lHlY2jZcHcljX+:qgFq6g10+f+MZftHl5mAu
MD5:	EFD69E9C9F90A6F9D64C715B10796FDB
SHA1:	4661101B31BC4775969608ABE23DFC40BE142FE3
SHA-256:	4246F0AE7D8E922FB5BC34B3543DD811C3CE09F241A93766C7A3EB0DED0E9688
SHA-512:	02F984DB4F335184529052E818F83436498EAE53DA615BAEA8E76A761C91F5F4C2A6368B811EC312A770766F436D089BC5F3ED891462D6BDAA07071DBDF8C200
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1456ee92469e466681e678a49549112d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77916n0NFhU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.442881713509006
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7OKBhgRTHnhTjshKe:SbFuFyLVIg1BG+f+MKKBhgRTHnhTjbVC
MD5:	EAF68CB36855AFB8B8206566CC587F07
SHA1:	19DE70B328CECA5ED31BB45E6DD5825350994396
SHA-256:	BC0757D570FF14532C8CF19ED438F5342106FD38DFE0EB37F36ACFE2E84F9952
SHA-512:	DFFA25D265A311765257A1D8D5B5A75822AA3B22EDF4BA8F5F503D0C110AFFAC84B3A6F522D6EAE78A015A996095888E0E4374D25765CD897C124BDF3A3F2CAC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c8015ad7cf6495b9537616b499a2068.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:779820rz8qR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.353774743895457
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MIUVHGAqJ7tATjNALyAZD:qgFq6g1af+MIURql+FIZD
MD5:	3CF6955AD82708060A389BA32D7EF5AA
SHA1:	C3EA8E9D786BD7C5EBF29BFAA0570C8CF5E0F75B
SHA-256:	B00A02CFCCAB36F34CAB9B2FFC70D9091A120A2EA555CBBAACB1C6402D3FC647
SHA-512:	AA0CB1C5F9CAA43AA435B7269B5BD17082060E69380DA72B42C50327E6CEE6C923904D5EB23A38CAD8780AD3A67A55E06AE8FB446820AD41323B687FA2F831A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a8c21d82aa0b41b0b8a2bf38cd11211a.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78036Z3qm9T

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.44183353222927
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvtTRmkERXBdNWNeg2js:SbFuFyLVIg1BAf+MZExBiNeTjNdQIeXD
MD5:	633DC7ABDAEEA32AA392F3A54D3E9329
SHA1:	FD540B879758064A07C7E6D7E332417B865E81C6
SHA-256:	971FEB775814977E6D9763236D98EE67C998831CF8A0CEA1C17BBDFEBE6F68FF
SHA-512:	FBC7A237E0A9C05780E1E738787DCF8791DA2D7A693ADD4294920D4A0BF316869414B73933D60AFF9DB4D87D7887263D504A9CEA1E8CD639053AC388A1ADE7C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9962d4eba3f42dd8ea5cd301f99b23d.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:781289vcgFR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388578193593639
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+SADEA82WTRjQBQBV:SbFuFyLVIg1BG+f+M+SiFWTWjLkGq
MD5:	9B625B3CFB4278681EEA8C78D90F9077
SHA1:	F0E2631FF6217E7ECF2F21B3A2324CCC7099825D
SHA-256:	FBF01B08CC106A5BB403188078805EC4258FF7E19BD2DE855692EE025275134B
SHA-512:	1984C790621E478098D4E585557790BBFD771C97667FB837681AF1A485D52B7B7A99F9B03D5FFD092F1548EC045271F49D5AC44B20D06630155CCE56007CDCF5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ca9be114ae74ee99a818468975d225d.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78137GD4mYR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.45882493727535
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoR+vCMZjdCt/rRMtq:qgFq6g10+f+MoRZOCDL
MD5:	7C9CBF10D25F5CA9D20B4500EBA6AFF1
SHA1:	58777F970E93BA88CD1F30162ABE6453D7F6BF38
SHA-256:	F5E05DE5168E7275A7A2D546A2D914308D9FD4C4D21A471ABD6A709DE9821F5E
SHA-512:	740EEA1417071643436AD1D445A24B9CE393FA94EC05CFCF2421AE6568D0F5BF80575591C61DAF3495765C0ACEA16D1298411B595A78E27FF963C2CB4DFC5B08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bafe127c4122487e979b015655155e12.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78161g4vZQS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.40869787631479
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsBXLuQ70sGes22js2BP:SbFuFyLVIg1BAf+MsBbuQ70eF2jNTZD
MD5:	5A1C3D2DE8B0377247736C1E900A2903
SHA1:	53E04E1C2E72AC71B3866A72E816AF66695F4F23
SHA-256:	6ADB92A22A2925E7AD83C52BA7434EFF9CB2B396802135E735759CFEED89126D
SHA-512:	D41A55957EDAA25A95824EB1F000C9AD881E2B3F4DA4CFE36567E68AC2F3EC19E38F5A8FE335C944A3CECC87D8193C1AB85048A9D8A71DF29080174D97BFBC4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd26bd8b1ff5435facb23d221a98c26e.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78265NKufRU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.461448425014382
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu80O+9n3jLTTIWTIL:qgFq6g10+f+MOLbEWEL
MD5:	7CEA78E75C0E7EA1415AD688E665B4D5
SHA1:	10577A73B8C68258A78FF132059DC6B1365746C7
SHA-256:	3FB959E19298B5B31B4040A937052BE3569ABF7449CF97B08CD78D504925227F
SHA-512:	D7D2C4FBC2EE83275F47046A3B1F489D65C20EE2D0401624340CD70EFDBD81BF80108D21FD4B6BF625F3667892CD0A715F7E724363CBF6B48FD432FCA512E9D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d29810a7bfd74c358fb16c8401e319f4.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78287GV003T

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.388330421683075
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrahAXBUBEm+sjsz:SbFuFyLVK6g7/+BG+f+MAy+jNq
MD5:	E52EAD06EB4DF311E68AEA145476C514
SHA1:	66B2FCAA0BA0639703294609D11C39CA2FA160E4
SHA-256:	30849A6791B2BC6397068E01C49BA4CF3CF7E7BD12B4F0916EA1EB767C198770
SHA-512:	919E1EDA33F17F11BA4A50881B8A83C99020148103DB684A7A52E77BC48610922A8788161DB9838D253821C30C6B4AA2C1A405574695A45A8B75AF7F0AB153FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afc4b6eec22d4f30be0af88da5ef6c12.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78288vELVJQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.376551691182198
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+B174cAILZjNq:qgFqdg7/+0+f+MoRAanq
MD5:	3EF513CDDCD48B17FE30202DC95FAA33
SHA1:	B076D9A3B2B6FA0F443125EBBED60E83ABD63042
SHA-256:	574E401ED2359868F17BC7DE7C00CB1CA1E91036D0FAEFE8093BD2C50D7DF32E
SHA-512:	2D456CBC55799CB9F1B2A906CA67976596F7393E0A6F6D21FAE7F310B182CCAEE9CFCA9668BDE5C2A53631A80591A82BB5AB7D114251995DB05A6E929452DAC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=70dcd5eddfdd4d5a95920fd493b7cfc1.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78301FWOqPU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.532516513573855
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8Z4ApyQVqjFQMzKaBu:qgFqo6g7/+0+f+M8PpyQCTmh
MD5:	39C4C6C396853F075A540433A6095F8A
SHA1:	C014EB3C94CC3A9AF7BB583B7361F931B8BB5636
SHA-256:	BA964BDD8CE3BEFDF3300E3681E10789E9013563B0A3963346F5664672E1B5D1
SHA-512:	AB950F1F1D3E9F352197E079D0DCD01DD9F7C41D3599184D246970F63C4CAA49CAD9A8E076E83FCA18D61BB55951631D3AC61E6CB721B8AF3C18D15DC4CA8E25
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c63340f9099469489c7e1e24153d4d1.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78302uzD4eT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.497693713446398
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M43u4T5lpjFQMzKaBu:qgFqdg7/+0+f+M4+grTmh
MD5:	3F8F132EFB311EED9D19D070A76A625A
SHA1:	F6F4D0F0DBB0BA882E26C0DA4F4A05C801D2E55D
SHA-256:	B5B988A573FBD9894B67ECECDF13526FBE25571EEF2EB9618EB062C073FDAFBA
SHA-512:	F4DBD68609D4F8D5C0793F031DD13AB101E8C2B0B51E6E2E74AB05540562060D151D7833886D977085DD618219520445B1C971C240222D66165DD1986BFF58BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=25803fb69da7424092dd57b646ee8d6e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78489RDZnzG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.48862143786184
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy2nwCQKX+HENe2rq+:SbFuFyLVIg1BG+f+MyCw2X+kNe22ji4s
MD5:	F9BAC7F0A50E6E649FF44E51E7266645
SHA1:	6449944A33E341DDF4DC6A0CA961CA1202710B75
SHA-256:	60B4D57FD7170F430A435BC6B951F07C5910943F58195311C0649D54A136A7D3
SHA-512:	2764221E7F86CF34EFA147DF622175CF841EFC977372FECA681D79B00A91325DC7189F743D1360C6A3FF9EAA5CD39CF95FF380518C3EDC2E9A223EE4BB7220F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83040bb44eca4e559a2eb83d5ad5b528.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78490Bi1d8G

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.403011971824396
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7McdR4jmDH0eD0Zjx:SbFuFyLVIg1BG+f+MxdamDHT4josQu
MD5:	3256DE8256B670B8CFB85CC50D30E6A4
SHA1:	803E8B89E18E79C4B40B21F19D9AE5A737F74FFC
SHA-256:	FD3FD931FE7653C2286FEA4F9264DAE17C2FA6C21A83CA46B9BFBEFFE15D2146
SHA-512:	6F8F0397D03362C7139CECDB40899D16A533F0756DEA0E16EAE3D3885BFF8F5858A2661CC25FDF9ECA79D43F269A96565E26CA7D69E5117A445196997E1A2A7A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1ab93b9644a141ecb37a9d1fb8c806ef.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:784986428vF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.421456753888204
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8BdwUsWRccjQ522je:SbFuFyLVIg1BG+f+M8BSHW6+2jdCLKzK
MD5:	B694BF7B5355C22FAC810FD74B3B877E
SHA1:	2CA2ABC0FF0F99CA9B1391DBE15B73BA5C5688F3
SHA-256:	C8EF32A4A1FD87BC5867F326A07382871334DF76D0E8329B99DE2561E840BA1D
SHA-512:	F6DEEA19D0B1F2D1C21E4F176AFCC2040811D05E3B4A88CEBA7FB74D079D026674BD9BB432D58F690CBA3CE240E6074F201070735B88E34F44B476681E4489D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6d88631bf42743499f07861e47251f66.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78513x4c5QF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.463692681185912
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MMJRDcJidNqjZcHcljX+:qgFq6g10+f+MM/kmAu
MD5:	A768F55C8FC499BA8A2219150A22CF04
SHA1:	B0DD48D11CBE90D783645228976DA7B7F454A94D
SHA-256:	0BF6C56BC6B6BC769CB8BAE9FF28DB506678565B25604CDDD280D27AB335BD75
SHA-512:	F5E04DF63D0C3C3A9793FEFFF27BF359F497A3D9E8BABBBDFAD0A372ADAFC00F74931C4A6F75E2B09F835FC1DEF61A6C99E5F97603EE082781886232F57CF5B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a226c086fac84c19a4a3e6efad474239.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78516sqYt7G

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5227955375734865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrxpJy6STd8js7LbgS:SbFuFyLVIg1BG+f+MjM6SKji4s
MD5:	E3D9D1B5C1DA929841D9B629DFC712A9
SHA1:	1E4056C5491B0B9E399C34A21147CE5F29101698
SHA-256:	E890EBB52A9F2D149E4D9057E26B23FE9872200DBD9F20D6CC34C2974F436729
SHA-512:	C24188EF887A40AF1D1E63965E23F51F3C3028393399C69E0C6CB49F6D345C8940CE2C4D8F74680EF97ADEAFBB04A20BD98912619CAE4A4F4B24FE5A57C21E60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a42d38a1572a48af9044b4d7ba7311e6.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78526iFODoF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.433263791031416
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyJ1BQPR6fGsbsA0js2o:SbFuFyLVIg1BAf+MyJUs+NA0jNALyAZD
MD5:	2D23699E25A36BB11ECFA05571E8B51D
SHA1:	0DB79CEEDFC8A61241524F958D180AE6CA690919
SHA-256:	B1C0C35B55405B762468EDD82D48C154AE439F07B5A0AFDC8887EA7B383C89F4
SHA-512:	2C8F45DB2A0C28E331A8C9FA82FA5FFB4C4B4561F8D12EFFF9B5793BD396793579FEE80B6F461882DAC6D72F157FC74100BF78C267EEFA5E21C7CC90AA043F34
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e92c9dd513449c09803795462c6ca8e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78527tln04H

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.404458645458927
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrECGVcjNuqjswkClK:SbFuFyLVIg1BG+f+MA/qjLkGq
MD5:	42708A52CE7782CBF8E1B300D2769AFE
SHA1:	DD8662720EC57AB36D35EFF718B224B542FB005B
SHA-256:	6B39BB65D583A0F0F2AC64615A9E2E64EB6B718B7ABAFA76C655FEC8D2185189
SHA-512:	581D4564AB331B9AF183E3B9515789F92F0ED44999F3DF626F84E869FBC76FC1167DF7D39DEA06EFF93256C7D0501D764C8CF82CA4EA957146ED2DF23F86F5C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3f6ebb9f3064cf094dd0c4043175d19.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80154QrFzMF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.449187176704596
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6hSulP+AX0hgrxsjs2y:SbFuFyLVIg1BAf+M6EuVC22jNdQIeXD
MD5:	8309210ECA916D46F0105CBC31FCE416
SHA1:	855509DF0429BA5F30AC38DB0594F79AF4EBA8F0
SHA-256:	1AABF2791706CD08AAFFAF4DD3FF017D205C321CF731B3A5C1CB61E474BD8FE4
SHA-512:	F2E23F7BB93DE3B01A0C7CB887A95A336ECF28A539758C3BE2D5EDF5BAC3A65EC7044DF06BAF9091BE47E8C32EEEBD637F92C6D9892763C9E911794F092CA949
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=007c0a71b3fb4facb1d8cb61738d8722.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/seats/.#seat08Sw3Vi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0bls9Du

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0t2bYBG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ygOyyH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0yqPVgv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1273Fn1nG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127509tMu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294277206476731
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgh12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgh8thQHtPYq9M
MD5:	1A5D39B2E85F276D03275AECD9380870
SHA1:	C75636266248964F0F67858FA7EEE71C91B20B26
SHA-256:	73BFEF17C6C00FA3FC9FDCE806B9CD6624A7C775E02BDCECEE684F563144E90B
SHA-512:	D2CB42CBACEFCBA78683658A6616E50876886918CE079200E45DBF8A25D8C76623394EF36008CF2CD5E0FFB53225B4E8F85DFDE09564DDA241A9DC4DB802D2A8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735413781370952.MONOTONIC=482538437.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127FJ9GTw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.32488768183109
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAQrQgQqWKwcpkWi206qodiadH:SbFuFyL3BVgdL87iesnAiRJghxot6/Qq
MD5:	0C8816E0C6A7432096700DD954E3F02F
SHA1:	8CF50466CA939E71FD25B84D8663547C5290DD9B
SHA-256:	FE740AEAA6CE83DE871EF602DBC008D0F9B808D2B71A6F9AAE628BDC63FBFFB9
SHA-512:	BC89A8DBE4C440C46F64A937F709708416C5ECD534AB7F843F95BCA2550C0EED9870CD51548E629662BC10ED809DBFB33D8C54FC9B3DD7C11F3EF0A81798A93E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735413781370952.MONOTONIC=482538437.LAST_SESSION_TIMESTAMP=482638594.

/run/systemd/users/.#127JAOgCw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.479543176742535
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68Cghxot6/QcRv:qgFq30dABibBAghOIXv
MD5:	0AC99FBC7EB21AE9E4CC4F47E6E2BDCE
SHA1:	9AC7A266EC8FF622AF1FE461E491810060680ACF
SHA-256:	8606196A64CBAE7BE87E73F96591376A18663FA45A584557E051563BDE4E053F
SHA-512:	858B8C2A1CD5830B4779FB06DFA19BC9811E35547BB6E637EE3050DA90441C3978B622BE950E56FA7F77CA598E269AEA67CFE842B5CC6F65ADEB8049DD14898C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1735413781370952.MONOTONIC=482538437.LAST_SESSION_TIMESTAMP=482638594.

/run/systemd/users/.#127MjLiLH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.318082325349771
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffsQCgqE5sQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUQCgqQsjthQHtPYqi
MD5:	D03CAE119EAA4A344936F9D9F79C4DF1
SHA1:	F9C18ABD73911F9E04DDB2DC46AA1B90FB7658FA
SHA-256:	4DC9570C74B9C23E975B167B08616341E2D26EC0CC1E4BD7705A79E65E3EB2F8
SHA-512:	A25A5A60DA8F34E3FF9BF55A333F5CACECFE2D8A19AAAEE530A523BA199FF601AEDC09BC5728DCF87D8C335A8E2E9E569F4EB1934430870D15BDE19D62C177AB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13278.REALTIME=1735413867882276.MONOTONIC=569049762.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127NeJSBv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294277206476731
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgh12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgh8thQHtPYq9M
MD5:	1A5D39B2E85F276D03275AECD9380870
SHA1:	C75636266248964F0F67858FA7EEE71C91B20B26
SHA-256:	73BFEF17C6C00FA3FC9FDCE806B9CD6624A7C775E02BDCECEE684F563144E90B
SHA-512:	D2CB42CBACEFCBA78683658A6616E50876886918CE079200E45DBF8A25D8C76623394EF36008CF2CD5E0FFB53225B4E8F85DFDE09564DDA241A9DC4DB802D2A8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735413781370952.MONOTONIC=482538437.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127NwidhJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.331803018140688
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAC9STW4xKXiW6H206qodtefv:SbFuFyL3BVgdL87iesnAiRJgqEbit6SH
MD5:	B0BCCB16FD7D2A5E10105582ECCD4A6B
SHA1:	2855977FFF8F32F839916AD2F4E5AB4B420C6ABE
SHA-256:	AEF83B5A7581AA9950402FF1F174DA490CB05B1C212A5F28390A69E2D0518C04
SHA-512:	AF68256D1BFC91348720D7AB5ECAEDA99EE182542CB3BD572AA39734CEFC153077682944AF3A5C44F819AF525BAE1FCC871E0A8A91709FC31B50FF0F0D44061B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735413867882276.MONOTONIC=569049762.LAST_SESSION_TIMESTAMP=569115366.

/run/systemd/users/.#127UaR9Eu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Uovd9G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.318082325349771
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffsQCgqE5sQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUQCgqQsjthQHtPYqi
MD5:	D03CAE119EAA4A344936F9D9F79C4DF1
SHA1:	F9C18ABD73911F9E04DDB2DC46AA1B90FB7658FA
SHA-256:	4DC9570C74B9C23E975B167B08616341E2D26EC0CC1E4BD7705A79E65E3EB2F8
SHA-512:	A25A5A60DA8F34E3FF9BF55A333F5CACECFE2D8A19AAAEE530A523BA199FF601AEDC09BC5728DCF87D8C335A8E2E9E569F4EB1934430870D15BDE19D62C177AB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13278.REALTIME=1735413867882276.MONOTONIC=569049762.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hEIy2E

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.495094436941462
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgqEbit6SH:qgFq30dABibB0Tgq9Io
MD5:	E486D3E6B79E2018DD2D3244FD4EDB4F
SHA1:	1402F74CAA309FC0EF96B98AC31A014B66498797
SHA-256:	7623A2B0A1E3A0085A660ED67B437E1A7B80CF401F092EFF4BA16B4753B49624
SHA-512:	91F9AFC49472DFD32CF67C8BFC95BA6B0F61728716602D5B22CBB1EBEA42BC1FCB539FA54021740B5385F23CDCF78C640F97FEFF60DD762E528427B7581C1EF5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1735413867882276.MONOTONIC=569049762.LAST_SESSION_TIMESTAMP=569115366.

/run/systemd/users/.#127lq0ZrJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.495094436941462
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgqEbit6SH:qgFq30dABibB0Tgq9Io
MD5:	E486D3E6B79E2018DD2D3244FD4EDB4F
SHA1:	1402F74CAA309FC0EF96B98AC31A014B66498797
SHA-256:	7623A2B0A1E3A0085A660ED67B437E1A7B80CF401F092EFF4BA16B4753B49624
SHA-512:	91F9AFC49472DFD32CF67C8BFC95BA6B0F61728716602D5B22CBB1EBEA42BC1FCB539FA54021740B5385F23CDCF78C640F97FEFF60DD762E528427B7581C1EF5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1735413867882276.MONOTONIC=569049762.LAST_SESSION_TIMESTAMP=569115366.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:KRv:KJ
MD5:	E048F22B4BA5E30F820BA7AF41391827
SHA1:	9D4706B2BBD19BDA0418CF5579B703B7E6DEF54A
SHA-256:	E3E2EEE565DA60E1DC8FF4A5063692EB66E26BF3FD76739EB0BD19E40D29C266
SHA-512:	2EC9C199F0B50B856C4E46CD68370B0F7B2279AE402BAB5D69F815511CB92D1B41AC2D4E034D38E5A6287E64412642728B5207C1F03143C2B8932BB47785A684
Malicious:	false
Preview:	6704.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Je:c
MD5:	986E29D0D8C888183B71B42D6411F1E0
SHA1:	FF2D676D4FED4AC7F83358A4C5F4C44484365BE5
SHA-256:	B92AE49933062E1BD2A71BA05BB93C101D1988AE61398FED9C38F0370ADCA57D
SHA-512:	3D887F79C3B60D231028EB491AF3A6747E4AF2AEF567C326D57476DE28CDC9740F41201B3E249A38B8BE3F8BA9D5582B4C011D1083D8D30BFE958C59815EE94D
Malicious:	false
Preview:	6739.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:YAsXlXEWtl/J:Yh+ylh
MD5:	2D0FCA1F797907B83CDFB9C3D2D3B086
SHA1:	D762EC196F3B4705602057DFAB009C9B018E9105
SHA-256:	A749E15644716340CC6752B3B75292B18A67A21ACDA9C83C663ECAB9F31FA1C9
SHA-512:	001DBF1AD7E9F80213BBD4B82AEC612F31ACC1D634A037FB5BF3332CA18E0E26DE0F581CB67F9EE6BF8145D7D3F8501CFB78C7669226A6468364674FAA38383D
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................ePpg'B......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ORv:OJ
MD5:	72E51F2660C3E269412B256CCA8DC1CF
SHA1:	D165E899C39FFFFD4986D209E5A8DEB56F42CD5F
SHA-256:	89CBD50B0466E628FC1C27DAFB887013CE21F278ACA2811CF96F6C6C1EE2C7CE
SHA-512:	71E26B4A20715D516FB3D33E14101ACBF7A80C797D63A6DFC458BAA27A943DDCAD7D1FB88539BEE1DE8BF899989FFCB93C46E0D891FA39033A3AEA403D231EDF
Malicious:	false
Preview:	6744.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Jt:j
MD5:	107E150D59919BBFD85A99D27851D287
SHA1:	46ED372B11A8BEC6690B3ED24AD11303392C0A5B
SHA-256:	51DD23A184A4DB5AFAAD951F54BC60BA064117A6173547C96A3A1753FD5E2A41
SHA-512:	0CFF865B17AC5C4D1D38BADD29DF8910E346CF2B150EB5F9C5270C77E9C4768EC66A696D57C1E71FA5B2FC76C3F347C4DB7F3510C48598A8A61EAB1686BB838D
Malicious:	false
Preview:	6738.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:IUvU:IUc
MD5:	D715AD1ED77752D5DEAE28E194C40270
SHA1:	760EFA3C37D512407F566D0D2E5EF2297CFB9AD5
SHA-256:	08A23E7BD3CAA8AA0913C28CF0AAAC09D2FA3332E01D317F3FA54EDCEE615066
SHA-512:	B3DC7CA9D2475AD798462A74DA4527172354D6B323E2699680946DF96FDAA5F6DED6325E0D67C5BACB006144E8BE7F48304D7F9CA49EBDEA367A54DFBFAAFAE0
Malicious:	false
Preview:	6721.6722.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Je:c
MD5:	986E29D0D8C888183B71B42D6411F1E0
SHA1:	FF2D676D4FED4AC7F83358A4C5F4C44484365BE5
SHA-256:	B92AE49933062E1BD2A71BA05BB93C101D1988AE61398FED9C38F0370ADCA57D
SHA-512:	3D887F79C3B60D231028EB491AF3A6747E4AF2AEF567C326D57476DE28CDC9740F41201B3E249A38B8BE3F8BA9D5582B4C011D1083D8D30BFE958C59815EE94D
Malicious:	false
Preview:	6739.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ORv:OJ
MD5:	72E51F2660C3E269412B256CCA8DC1CF
SHA1:	D165E899C39FFFFD4986D209E5A8DEB56F42CD5F
SHA-256:	89CBD50B0466E628FC1C27DAFB887013CE21F278ACA2811CF96F6C6C1EE2C7CE
SHA-512:	71E26B4A20715D516FB3D33E14101ACBF7A80C797D63A6DFC458BAA27A943DDCAD7D1FB88539BEE1DE8BF899989FFCB93C46E0D891FA39033A3AEA403D231EDF
Malicious:	false
Preview:	6744.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Jt:j
MD5:	107E150D59919BBFD85A99D27851D287
SHA1:	46ED372B11A8BEC6690B3ED24AD11303392C0A5B
SHA-256:	51DD23A184A4DB5AFAAD951F54BC60BA064117A6173547C96A3A1753FD5E2A41
SHA-512:	0CFF865B17AC5C4D1D38BADD29DF8910E346CF2B150EB5F9C5270C77E9C4768EC66A696D57C1E71FA5B2FC76C3F347C4DB7F3510C48598A8A61EAB1686BB838D
Malicious:	false
Preview:	6738.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:IUvU:IUc
MD5:	D715AD1ED77752D5DEAE28E194C40270
SHA1:	760EFA3C37D512407F566D0D2E5EF2297CFB9AD5
SHA-256:	08A23E7BD3CAA8AA0913C28CF0AAAC09D2FA3332E01D317F3FA54EDCEE615066
SHA-512:	B3DC7CA9D2475AD798462A74DA4527172354D6B323E2699680946DF96FDAA5F6DED6325E0D67C5BACB006144E8BE7F48304D7F9CA49EBDEA367A54DFBFAAFAE0
Malicious:	false
Preview:	6721.6722.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Je:c
MD5:	986E29D0D8C888183B71B42D6411F1E0
SHA1:	FF2D676D4FED4AC7F83358A4C5F4C44484365BE5
SHA-256:	B92AE49933062E1BD2A71BA05BB93C101D1988AE61398FED9C38F0370ADCA57D
SHA-512:	3D887F79C3B60D231028EB491AF3A6747E4AF2AEF567C326D57476DE28CDC9740F41201B3E249A38B8BE3F8BA9D5582B4C011D1083D8D30BFE958C59815EE94D
Malicious:	false
Preview:	6739.

/tmp/qemu-open.wqoWjI (deleted)

Download File

Process:	/tmp/fnkea7.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.056020968057881
Encrypted:	false
SSDEEP:	3:TgA78HJN:TgAKJN
MD5:	DDA8A2C2CDBED8242E6613F9F91554AD
SHA1:	B2173D9FBA6CE0674B1BB8C895DFFCD31F046BBC
SHA-256:	5F294B98DEF330F44076FC4698C77B36A72A1F12859E29DE92098CE92361A6CE
SHA-512:	2BFFB04D993D23ECEF225B6AAA9BB7DC3E7A10754ECBF497932C06E0DA7C9A1C95E1617FE01E0685242E4AC9B46EC2BB47AC0F5B20A7F3AE5DDB3A692B336ADC
Malicious:	false
Preview:	/tmp/fnkea7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.IWEWZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.UK8HZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.933566985299767
Encrypted:	false
SSDEEP:	24:8ZeaSGqbbuAvpA2+Vl1UUOS0pYrtCJrEZrCQU:DvufVzUrtYrtkrEZrCn
MD5:	13659C836CA5CFD8161EEC4F772FDE3F
SHA1:	097A8156556680A0A581E6E5E3F064BAC80E6787
SHA-256:	6401E281F9BBF4F9C71D625D6647967AE52E9D335C4A9EDCE9D10F5F4FABA424
SHA-512:	4D2A4E79C10BBEF7D12BCBBCF59F7592745D83810FDAA1A711434880CD244A8BBC4FF1E9F054DCA572528838FBC5E19DF7657668A3D305E8023762C19C57DA4A
Malicious:	false
Preview:	Dec 28 13:24:23 galassia systemd-logind[6619]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 13:24:23 galassia systemd-logind[6619]: User enumeration failed: Invalid argument.Dec 28 13:24:23 galassia systemd-logind[6619]: User of session c2 not known..Dec 28 13:24:23 galassia systemd-logind[6619]: User of session 2 not known..Dec 28 13:24:23 galassia systemd-logind[6619]: Session enumeration failed: No such file or directory.Dec 28 13:24:23 galassia systemd-logind[6619]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 13:24:23 galassia systemd-logind[6619]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 13:24:24 galassia systemd-logind[6619]: New seat seat0..Dec 28 13:24:27 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 13:24:27 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 13:24:27

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlZlWg1BlWwtl:F3plWgXlWQ
MD5:	4653F337B26E6AC3DF20E1ACECFA5853
SHA1:	7463D57BB3C1BB82671D475C5A6A28A9E8E3AFA9
SHA-256:	8972FD09796983C13807D1EA1F1EBBB27D4C2314C63E53D9E4FB14D86B4B6716
SHA-512:	8EB9E6345FEC5E0872D31A942C76FA53E3EE7201A81E78A999A6F54AC678855F8A5C9CE25C359C785BAC00B3F96DB798F78396ECA88EBCBF4609E9CD765FE6E2
Malicious:	false
Preview:	LPKSHHRH..................r7.DA..5.......................................r7.DA..5.............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hl0Fx2kB/ll/sFx2kBV:F3qL4j
MD5:	B300E73F53826EC1726DBC803131101F
SHA1:	BD66C7EE03A3DDF32BC7D3EE6FEA208FA750BF7D
SHA-256:	56F7B9A2D4BB3BA92EF8160FB09F3746A95FB120ED934C756B6B08D3BA671453
SHA-512:	A2DF2E99D88EE4F01A8CA3A40D40B1C13A6AC70F77B810358FA772C20736FACEDD099D5A059C5D12E4AAB31EDC801FC28B0F918141CD20192DF8FB9F68793D8E
Malicious:	false
Preview:	LPKSHHRH.....................E.(....>d.....................................E.(....>d........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9875
Entropy (8bit):	5.008764983882044
Encrypted:	false
SSDEEP:	96:SkaZe9m7WOr8M8PYCO6Xa+26AvOjxdrBwlLUUndTZ:Pu7Zr8t+Mb26AMxdrJUnd9
MD5:	00E5CAE4A105C9A53B18CEABBCD20EAD
SHA1:	AFC89A8409CFAA2C358723B893C93C8CBD53B1E7
SHA-256:	DEEC3E6B1B264512DFAAA81E2F5D32492D87758A4C0263FE7DA932DAD820D4DA
SHA-512:	28849E7BF9E2D22732B646CB4C82C005AC5D8A77ECBACDFAE7AE3DEA2FAFAEAD8F03390C766A10E5A050CA710B9B816481DE031F600130818BDE655DFEEE991A
Malicious:	false
Preview:	Dec 28 13:24:16 galassia kernel: [ 557.142455] New task spawned: old: (tgid 6676, tid 6676), new (tgid: 6676, tid: 6679).Dec 28 13:24:16 galassia kernel: [ 557.142572] New task spawned: old: (tgid 6676, tid 6676), new (tgid: 6676, tid: 6680).Dec 28 13:24:17 galassia kernel: [ 557.167425] New task spawned: old: (tgid 6676, tid 6680), new (tgid: 6676, tid: 6681).Dec 28 13:24:17 galassia kernel: [ 558.419869] New task spawned: old: (tgid 6677, tid 6677), new (tgid: 6677, tid: 6682).Dec 28 13:24:17 galassia kernel: [ 558.711098] New task spawned: old: (tgid 6677, tid 6677), new (tgid: 6677, tid: 6683).Dec 28 13:24:17 galassia kernel: [ 558.804449] New task spawned: old: (tgid 6677, tid 6677), new (tgid: 6677, tid: 6684).Dec 28 13:24:19 galassia kernel: [ 558.901127] New task spawned: old: (tgid 6677, tid 6677), new (tgid: 6677, tid: 6685).Dec 28 13:24:19 galassia kernel: [ 560.460413] New task spawned: old: (tgid 6688, tid 6688), new (tgid: 6688, tid: 6689).Dec 28 13:24:19 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	26954
Entropy (8bit):	5.139311261695452
Encrypted:	false
SSDEEP:	768:kcTTHpGpeiWYiQ4C7pLw6aMg/lZtjcxJ7V5r1+uCQCEgO3/71l3TxOsIK1Hbpr:MaUJBJ
MD5:	F5657C238D5987BD5ECFF5126F86A6D5
SHA1:	FFC7A07E8305BAC48F7EC58D701EA27CDC4C4645
SHA-256:	5B96E44F774454351C0A99EEDBBDC1F11F1A97F10943E0902B7EA821D3AAD677
SHA-512:	FE1CF35FAC9733E1B532F7453B5F0295EE2549DF39C99204DB58B67948AB8A2266D6C83E8A792E648EF80B01F9FBDE846955BBC02E03A6CDA45D5D025B901928
Malicious:	false
Preview:	Dec 28 13:24:16 galassia kernel: [ 556.577631] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 28 13:24:16 galassia kernel: [ 556.577714] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 28 13:24:16 galassia kernel: [ 556.584773] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 28 13:24:16 galassia kernel: [ 556.584779] systemd[1]: dbus.service: Failed with result 'signal'..Dec 28 13:24:16 galassia kernel: [ 556.587002] systemd[1]: Started D-Bus System Message Bus..Dec 28 13:24:16 galassia kernel: [ 556.593042] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 28 13:24:16 galassia kernel: [ 556.593196] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 28 13:24:16 galassia kernel: [ 556.594109] systemd[1]: getty@tty2.service: Succeeded..Dec 28 13:24:16 galassia kernel: [ 556.595193] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 2

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:YAsXlXEWtl/J:Yh+ylh
MD5:	2D0FCA1F797907B83CDFB9C3D2D3B086
SHA1:	D762EC196F3B4705602057DFAB009C9B018E9105
SHA-256:	A749E15644716340CC6752B3B75292B18A67A21ACDA9C83C663ECAB9F31FA1C9
SHA-512:	001DBF1AD7E9F80213BBD4B82AEC612F31ACC1D634A037FB5BF3332CA18E0E26DE0F581CB67F9EE6BF8145D7D3F8501CFB78C7669226A6468364674FAA38383D
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................ePpg'B......................................

Source: fnkea7.elf	ReversingLabs: Detection: 52%
Source: fnkea7.elf	Virustotal: Detection: 53%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:53456 -> 178.215.238.153:33966
Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.978436672536805
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fnkea7.elf
File size:	217'047 bytes
MD5:	9459f8d509e4be4d841e2a9d29aae54e
SHA1:	3db5f9abc13b59ee3291704259feac81238c0ec6
SHA256:	635589bbf5d0b0a3b1fc77ab35087010897be88b7b7cce68b952663a2f929768
SHA512:	7fa25108ed342cfb9bf47ae1e654346fd71ba82a3f90bc05cdd1745437c4661558de754fe358db3ea15f83d89224bf66842b9f904dfa04a22f941085c67c802a
SSDEEP:	6144:9LziNEEQ/E8OFR3h0sEiaUVB1ILe6uuQdtEwCSw0M/RZmhY:96NHMTc39EiaaB1ILXPgEKwJ/HmO
TLSH:	1E241946AA418F13C4D727BAF6DF42453333A75493EB73069924AFB43B8679E4F22601
File Content Preview:	.ELF..............(.........4...d.......4. ...(........p............x...x................................................................U..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	171108
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1de58	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x25f48	0x1df48	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25f58	0x1df58	0x2a14	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2896c	0x2096c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x28984	0x20984	0x178	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x31000	0x21000	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x31004	0x21004	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x31008	0x21008	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x31008	0x21008	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x3100c	0x2100c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x31010	0x21010	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x31014	0x21014	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x310d4	0x210d4	0x2f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x313c4	0x213c4	0x5234	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x213c4	0x108a	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x22450	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x225d0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x2280e	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x252b5	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25c4f	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x26ddc	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x27118	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x27bd4	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x293fe	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x29b2e	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x29b44	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a114	0x7160	0x10	0x0		29	1064	4
.strtab	STRTAB	0x0	0x31274	0x3d63	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x20984	0x28984	0x28984	0x178	0x178	4.6653	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20afc	0x20afc	6.1162	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x21000	0x31000	0x31000	0x3c4	0x55f8	4.7007	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x21004	0x31004	0x31004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 20:22:43.958391905 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 20:24:03.969109058 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 20:21:54.062561035 CET	192.168.2.23	8.8.8.8	0x506d	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:21:54.302545071 CET	192.168.2.23	8.8.8.8	0x6312	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 20:21:54.427057028 CET	192.168.2.23	8.8.8.8	0x6312	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 20:21:54.553137064 CET	192.168.2.23	8.8.8.8	0x6312	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 20:21:54.679464102 CET	192.168.2.23	8.8.8.8	0x6312	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 20:21:54.803344965 CET	192.168.2.23	8.8.8.8	0x6312	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 20:21:56.989917994 CET	192.168.2.23	8.8.8.8	0x6c4d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 20:21:57.188957930 CET	192.168.2.23	8.8.8.8	0x6c4d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 20:21:57.353970051 CET	192.168.2.23	8.8.8.8	0x6c4d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 20:21:57.478987932 CET	192.168.2.23	8.8.8.8	0x6c4d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 20:21:57.602910995 CET	192.168.2.23	8.8.8.8	0x6c4d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 20:21:59.797539949 CET	192.168.2.23	8.8.8.8	0x94fa	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	471	false
Dec 28, 2024 20:21:59.920598984 CET	192.168.2.23	8.8.8.8	0x94fa	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 20:22:00.044121981 CET	192.168.2.23	8.8.8.8	0x94fa	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 20:22:00.167365074 CET	192.168.2.23	8.8.8.8	0x94fa	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 20:22:00.291052103 CET	192.168.2.23	8.8.8.8	0x94fa	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 20:22:02.429357052 CET	192.168.2.23	8.8.8.8	0xa8c3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 20:22:02.552628040 CET	192.168.2.23	8.8.8.8	0xa8c3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 20:22:02.682497025 CET	192.168.2.23	8.8.8.8	0xa8c3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 20:22:02.807631016 CET	192.168.2.23	8.8.8.8	0xa8c3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 20:22:02.930661917 CET	192.168.2.23	8.8.8.8	0xa8c3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 20:22:05.103600025 CET	192.168.2.23	8.8.8.8	0x575a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 20:22:05.227160931 CET	192.168.2.23	8.8.8.8	0x575a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 20:22:05.350528002 CET	192.168.2.23	8.8.8.8	0x575a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 20:22:05.474015951 CET	192.168.2.23	8.8.8.8	0x575a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 20:22:05.597398043 CET	192.168.2.23	8.8.8.8	0x575a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 20:22:07.953304052 CET	192.168.2.23	8.8.8.8	0xe276	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	479	false
Dec 28, 2024 20:22:08.077078104 CET	192.168.2.23	8.8.8.8	0xe276	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 20:22:08.200514078 CET	192.168.2.23	8.8.8.8	0xe276	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 20:22:08.324084997 CET	192.168.2.23	8.8.8.8	0xe276	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 20:22:08.447796106 CET	192.168.2.23	8.8.8.8	0xe276	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 20:22:11.160041094 CET	192.168.2.23	8.8.8.8	0x27b2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 28, 2024 20:22:11.441359997 CET	192.168.2.23	8.8.8.8	0x27b2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 28, 2024 20:22:11.564809084 CET	192.168.2.23	8.8.8.8	0x27b2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 28, 2024 20:22:11.691152096 CET	192.168.2.23	8.8.8.8	0x27b2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 28, 2024 20:22:11.815516949 CET	192.168.2.23	8.8.8.8	0x27b2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Dec 28, 2024 20:22:13.961034060 CET	192.168.2.23	8.8.8.8	0x3cb4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 28, 2024 20:22:14.089850903 CET	192.168.2.23	8.8.8.8	0x3cb4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 28, 2024 20:22:14.213712931 CET	192.168.2.23	8.8.8.8	0x3cb4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 28, 2024 20:22:14.336788893 CET	192.168.2.23	8.8.8.8	0x3cb4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 28, 2024 20:22:14.463170052 CET	192.168.2.23	8.8.8.8	0x3cb4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	486	false
Dec 28, 2024 20:22:16.641241074 CET	192.168.2.23	8.8.8.8	0x31e5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Dec 28, 2024 20:22:16.764204025 CET	192.168.2.23	8.8.8.8	0x31e5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Dec 28, 2024 20:22:16.888782978 CET	192.168.2.23	8.8.8.8	0x31e5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Dec 28, 2024 20:22:17.011993885 CET	192.168.2.23	8.8.8.8	0x31e5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 28, 2024 20:22:17.136806965 CET	192.168.2.23	8.8.8.8	0x31e5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 28, 2024 20:22:19.306952000 CET	192.168.2.23	8.8.8.8	0x768c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 28, 2024 20:22:19.429706097 CET	192.168.2.23	8.8.8.8	0x768c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 28, 2024 20:22:19.555777073 CET	192.168.2.23	8.8.8.8	0x768c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 28, 2024 20:22:19.678750992 CET	192.168.2.23	8.8.8.8	0x768c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 28, 2024 20:22:19.801713943 CET	192.168.2.23	8.8.8.8	0x768c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Dec 28, 2024 20:22:22.019742012 CET	192.168.2.23	8.8.8.8	0xe4bc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 28, 2024 20:22:22.142693043 CET	192.168.2.23	8.8.8.8	0xe4bc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 28, 2024 20:22:22.268476963 CET	192.168.2.23	8.8.8.8	0xe4bc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 28, 2024 20:22:22.391522884 CET	192.168.2.23	8.8.8.8	0xe4bc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 28, 2024 20:22:22.514749050 CET	192.168.2.23	8.8.8.8	0xe4bc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	494	false
Dec 28, 2024 20:22:24.650006056 CET	192.168.2.23	8.8.8.8	0x1744	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Dec 28, 2024 20:22:24.773504972 CET	192.168.2.23	8.8.8.8	0x1744	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Dec 28, 2024 20:22:24.896749020 CET	192.168.2.23	8.8.8.8	0x1744	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Dec 28, 2024 20:22:25.021308899 CET	192.168.2.23	8.8.8.8	0x1744	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	497	false
Dec 28, 2024 20:22:25.247843981 CET	192.168.2.23	8.8.8.8	0x1744	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	497	false
Dec 28, 2024 20:22:27.436811924 CET	192.168.2.23	8.8.8.8	0x3972	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Dec 28, 2024 20:22:27.561999083 CET	192.168.2.23	8.8.8.8	0x3972	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Dec 28, 2024 20:22:27.685862064 CET	192.168.2.23	8.8.8.8	0x3972	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Dec 28, 2024 20:22:27.809628963 CET	192.168.2.23	8.8.8.8	0x3972	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Dec 28, 2024 20:22:27.937329054 CET	192.168.2.23	8.8.8.8	0x3972	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Dec 28, 2024 20:22:30.158029079 CET	192.168.2.23	8.8.8.8	0x25ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Dec 28, 2024 20:22:30.281514883 CET	192.168.2.23	8.8.8.8	0x25ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Dec 28, 2024 20:22:30.405168056 CET	192.168.2.23	8.8.8.8	0x25ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Dec 28, 2024 20:22:30.529639006 CET	192.168.2.23	8.8.8.8	0x25ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Dec 28, 2024 20:22:30.653218031 CET	192.168.2.23	8.8.8.8	0x25ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Dec 28, 2024 20:22:32.782772064 CET	192.168.2.23	8.8.8.8	0xb91	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Dec 28, 2024 20:22:32.906191111 CET	192.168.2.23	8.8.8.8	0xb91	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Dec 28, 2024 20:22:33.029731989 CET	192.168.2.23	8.8.8.8	0xb91	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	505	false
Dec 28, 2024 20:22:33.153069973 CET	192.168.2.23	8.8.8.8	0xb91	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	505	false
Dec 28, 2024 20:22:33.276062012 CET	192.168.2.23	8.8.8.8	0xb91	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	505	false
Dec 28, 2024 20:22:35.492630005 CET	192.168.2.23	8.8.8.8	0xc990	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Dec 28, 2024 20:22:35.616115093 CET	192.168.2.23	8.8.8.8	0xc990	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Dec 28, 2024 20:22:35.740770102 CET	192.168.2.23	8.8.8.8	0xc990	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Dec 28, 2024 20:22:35.863917112 CET	192.168.2.23	8.8.8.8	0xc990	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Dec 28, 2024 20:22:35.987675905 CET	192.168.2.23	8.8.8.8	0xc990	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Dec 28, 2024 20:22:38.182249069 CET	192.168.2.23	8.8.8.8	0x3452	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Dec 28, 2024 20:22:38.312262058 CET	192.168.2.23	8.8.8.8	0x3452	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Dec 28, 2024 20:22:38.435650110 CET	192.168.2.23	8.8.8.8	0x3452	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Dec 28, 2024 20:22:38.558993101 CET	192.168.2.23	8.8.8.8	0x3452	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Dec 28, 2024 20:22:38.681895971 CET	192.168.2.23	8.8.8.8	0x3452	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Dec 28, 2024 20:22:40.917090893 CET	192.168.2.23	8.8.8.8	0xb65f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Dec 28, 2024 20:22:41.039957047 CET	192.168.2.23	8.8.8.8	0xb65f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	257	false
Dec 28, 2024 20:22:41.162900925 CET	192.168.2.23	8.8.8.8	0xb65f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	257	false
Dec 28, 2024 20:22:41.290997982 CET	192.168.2.23	8.8.8.8	0xb65f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	257	false
Dec 28, 2024 20:22:41.415132046 CET	192.168.2.23	8.8.8.8	0xb65f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	257	false
Dec 28, 2024 20:22:43.323174000 CET	192.168.2.23	1.1.1.1	0x569e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:22:43.323174000 CET	192.168.2.23	1.1.1.1	0x1664	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 20:22:43.616525888 CET	192.168.2.23	8.8.8.8	0x51f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	259	false
Dec 28, 2024 20:22:43.742917061 CET	192.168.2.23	8.8.8.8	0x51f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	259	false
Dec 28, 2024 20:22:43.827059031 CET	192.168.2.23	1.1.1.1	0xe13c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 20:22:43.871392012 CET	192.168.2.23	8.8.8.8	0x51f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	259	false
Dec 28, 2024 20:22:44.001606941 CET	192.168.2.23	8.8.8.8	0x51f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	260	false
Dec 28, 2024 20:22:44.131619930 CET	192.168.2.23	8.8.8.8	0x51f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	260	false
Dec 28, 2024 20:22:46.378156900 CET	192.168.2.23	8.8.8.8	0xd280	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 28, 2024 20:22:46.507349968 CET	192.168.2.23	8.8.8.8	0xd280	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 28, 2024 20:22:46.633311033 CET	192.168.2.23	8.8.8.8	0xd280	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 28, 2024 20:22:46.761058092 CET	192.168.2.23	8.8.8.8	0xd280	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 28, 2024 20:22:46.888209105 CET	192.168.2.23	8.8.8.8	0xd280	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	262	false
Dec 28, 2024 20:22:49.074269056 CET	192.168.2.23	8.8.8.8	0xb547	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 28, 2024 20:22:49.197803974 CET	192.168.2.23	8.8.8.8	0xb547	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 28, 2024 20:22:49.321358919 CET	192.168.2.23	8.8.8.8	0xb547	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 28, 2024 20:22:49.446536064 CET	192.168.2.23	8.8.8.8	0xb547	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 28, 2024 20:22:49.570444107 CET	192.168.2.23	8.8.8.8	0xb547	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	265	false
Dec 28, 2024 20:22:52.692554951 CET	192.168.2.23	8.8.8.8	0x88eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 28, 2024 20:22:52.817648888 CET	192.168.2.23	8.8.8.8	0x88eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 28, 2024 20:22:52.942645073 CET	192.168.2.23	8.8.8.8	0x88eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	268	false
Dec 28, 2024 20:22:53.066670895 CET	192.168.2.23	8.8.8.8	0x88eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	269	false
Dec 28, 2024 20:22:53.190514088 CET	192.168.2.23	8.8.8.8	0x88eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	269	false
Dec 28, 2024 20:22:55.375252008 CET	192.168.2.23	8.8.8.8	0xaa36	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 28, 2024 20:22:55.498198032 CET	192.168.2.23	8.8.8.8	0xaa36	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 28, 2024 20:22:55.621144056 CET	192.168.2.23	8.8.8.8	0xaa36	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 28, 2024 20:22:55.744479895 CET	192.168.2.23	8.8.8.8	0xaa36	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 28, 2024 20:22:55.867423058 CET	192.168.2.23	8.8.8.8	0xaa36	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 28, 2024 20:23:22.221033096 CET	192.168.2.23	8.8.8.8	0x4ed7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 28, 2024 20:23:22.343866110 CET	192.168.2.23	8.8.8.8	0x4ed7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 28, 2024 20:23:22.466994047 CET	192.168.2.23	8.8.8.8	0x4ed7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 28, 2024 20:23:22.590895891 CET	192.168.2.23	8.8.8.8	0x4ed7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 28, 2024 20:23:22.713843107 CET	192.168.2.23	8.8.8.8	0x4ed7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 28, 2024 20:23:24.944029093 CET	192.168.2.23	8.8.8.8	0x99d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	301	false
Dec 28, 2024 20:23:25.067595005 CET	192.168.2.23	8.8.8.8	0x99d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	301	false
Dec 28, 2024 20:23:25.190835953 CET	192.168.2.23	8.8.8.8	0x99d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	301	false
Dec 28, 2024 20:23:25.313844919 CET	192.168.2.23	8.8.8.8	0x99d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	301	false
Dec 28, 2024 20:23:25.437402964 CET	192.168.2.23	8.8.8.8	0x99d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	301	false
Dec 28, 2024 20:23:27.771789074 CET	192.168.2.23	8.8.8.8	0xa8f6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	303	false
Dec 28, 2024 20:23:27.901669025 CET	192.168.2.23	8.8.8.8	0xa8f6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 20:23:28.080976009 CET	192.168.2.23	8.8.8.8	0xa8f6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 20:23:28.204041004 CET	192.168.2.23	8.8.8.8	0xa8f6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 20:23:28.326905012 CET	192.168.2.23	8.8.8.8	0xa8f6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 20:23:30.514576912 CET	192.168.2.23	8.8.8.8	0x9992	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	306	false
Dec 28, 2024 20:23:30.637999058 CET	192.168.2.23	8.8.8.8	0x9992	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	306	false
Dec 28, 2024 20:23:30.912133932 CET	192.168.2.23	8.8.8.8	0x9992	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	306	false
Dec 28, 2024 20:23:31.035691023 CET	192.168.2.23	8.8.8.8	0x9992	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 20:23:31.159971952 CET	192.168.2.23	8.8.8.8	0x9992	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 20:23:33.322825909 CET	192.168.2.23	8.8.8.8	0x4e8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 20:23:33.455858946 CET	192.168.2.23	8.8.8.8	0x4e8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 20:23:33.590059042 CET	192.168.2.23	8.8.8.8	0x4e8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 20:23:33.713308096 CET	192.168.2.23	8.8.8.8	0x4e8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 20:23:33.836656094 CET	192.168.2.23	8.8.8.8	0x4e8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 20:23:36.264744997 CET	192.168.2.23	8.8.8.8	0x8c45	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 20:23:36.402683973 CET	192.168.2.23	8.8.8.8	0x8c45	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 20:23:36.527728081 CET	192.168.2.23	8.8.8.8	0x8c45	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 20:23:36.657037020 CET	192.168.2.23	8.8.8.8	0x8c45	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 20:23:36.797102928 CET	192.168.2.23	8.8.8.8	0x8c45	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 20:23:38.955162048 CET	192.168.2.23	8.8.8.8	0x48a4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 20:23:39.078239918 CET	192.168.2.23	8.8.8.8	0x48a4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 20:23:39.201180935 CET	192.168.2.23	8.8.8.8	0x48a4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 20:23:39.324188948 CET	192.168.2.23	8.8.8.8	0x48a4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 20:23:39.447216034 CET	192.168.2.23	8.8.8.8	0x48a4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 20:23:41.642997980 CET	192.168.2.23	8.8.8.8	0xfbed	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	317	false
Dec 28, 2024 20:23:41.766016006 CET	192.168.2.23	8.8.8.8	0xfbed	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	317	false
Dec 28, 2024 20:23:41.889377117 CET	192.168.2.23	8.8.8.8	0xfbed	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	317	false
Dec 28, 2024 20:23:42.012592077 CET	192.168.2.23	8.8.8.8	0xfbed	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	318	false
Dec 28, 2024 20:23:42.135613918 CET	192.168.2.23	8.8.8.8	0xfbed	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	318	false
Dec 28, 2024 20:24:02.551892042 CET	192.168.2.23	1.1.1.1	0x5b58	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 20:24:02.551892042 CET	192.168.2.23	1.1.1.1	0x2b27	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:24:18.721221924 CET	192.168.2.23	1.1.1.1	0x9b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 20:21:54.301126957 CET	8.8.8.8	192.168.2.23	0x506d	No error (0)	raw.cardiacpure.ru	178.215.238.153	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:22:43.461163044 CET	1.1.1.1	192.168.2.23	0x569e	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:22:43.461163044 CET	1.1.1.1	192.168.2.23	0x569e	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:24:02.782893896 CET	1.1.1.1	192.168.2.23	0x2b27	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 20:24:02.782893896 CET	1.1.1.1	192.168.2.23	0x2b27	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-28 19:22:48 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 19:22:49 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 19:22:49 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 19:22:51 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 19:22:51 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	19:21:53
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	/tmp/fnkea7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:23:05
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:24:04
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:22:35
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:37
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:40
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:41
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:42
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:22:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fnkea7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6476/oom_score_adj

/proc/6732/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1080403ElV619

/run/systemd/journal/streams/.#9:1080416pn7Czb

/run/systemd/journal/streams/.#9:1080418KfPjsb

/run/systemd/journal/streams/.#9:1080602yJOqT9

/run/systemd/journal/streams/.#9:10806506kuti8

/run/systemd/journal/streams/.#9:1080792iGUdR7

/run/systemd/journal/streams/.#9:589494k878x9

/run/systemd/journal/streams/.#9:601112abpfV7

/run/systemd/journal/streams/.#9:6021670LgnU7

/run/systemd/journal/streams/.#9:704423TePUS7

/run/systemd/journal/streams/.#9:704431967K3b

/run/systemd/journal/streams/.#9:721151rkwGt9

/run/systemd/journal/streams/.#9:731485yytK7a

/run/systemd/journal/streams/.#9:731997c592xa

/run/systemd/journal/streams/.#9:731998DTe0q8

/run/systemd/journal/streams/.#9:732004NaaQ87

/run/systemd/journal/streams/.#9:732011sEJMH8

/run/systemd/journal/streams/.#9:732020CYmFJa

Linux Analysis Report
fnkea7.elf

Start time (UTC):	19:22:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:22:48
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:47
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:51
Start date (UTC):	28/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	19:22:58
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:22:59
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:23:00
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:23:01
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	19:23:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	19:23:59
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75