Edit tour

Linux Analysis Report
wkb86.elf

Overview

General Information

Sample name:	wkb86.elf
Analysis ID:	1581720
MD5:	7a27473790125d4b47574c56c08034cb
SHA1:	0770d21c7616d8e7e78584246ded03559eba1ce1
SHA256:	d4b845fcb1189d00e1d2d3adb8bcd9ac93cbc3d071239b113a9a58dd73d3f88a
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581720
Start date and time:	2024-12-28 20:26:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wkb86.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/162@73/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/wkb86.elf
PID:	6239
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wkb86.elf (PID: 6239, Parent: 6159, MD5: 7a27473790125d4b47574c56c08034cb) Arguments: /tmp/wkb86.elf

wkb86.elf New Fork (PID: 6240, Parent: 6239)

wkb86.elf New Fork (PID: 6241, Parent: 6240)

wkb86.elf New Fork (PID: 6400, Parent: 6241)

sh (PID: 6400, Parent: 6241, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6401, Parent: 6400)

ps (PID: 6401, Parent: 6400, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wkb86.elf New Fork (PID: 6901, Parent: 6241)

sh (PID: 6901, Parent: 6241, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6902, Parent: 6901)

ps (PID: 6902, Parent: 6901, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6242, Parent: 1477)

sh (PID: 6242, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6242, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6247, Parent: 1)

systemd-hostnamed (PID: 6247, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6395, Parent: 1320)

Default (PID: 6395, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6399, Parent: 1320)

Default (PID: 6399, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6461, Parent: 1)

journalctl (PID: 6461, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6482, Parent: 1)

systemd-journald (PID: 6482, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6483, Parent: 1)

journalctl (PID: 6483, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6490, Parent: 1)

dbus-daemon (PID: 6490, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6499, Parent: 1320)

Default (PID: 6499, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6501, Parent: 1860)

pulseaudio (PID: 6501, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6503, Parent: 1)

rsyslogd (PID: 6503, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6505, Parent: 1)

rtkit-daemon (PID: 6505, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6508, Parent: 1)

systemd-logind (PID: 6508, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6573, Parent: 1)

polkitd (PID: 6573, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6578, Parent: 1)

gpu-manager (PID: 6578, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6579, Parent: 6578)

sh (PID: 6579, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6580, Parent: 6579)

grep (PID: 6580, Parent: 6579, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6585, Parent: 6578)

sh (PID: 6585, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6586, Parent: 6585)

grep (PID: 6586, Parent: 6585, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6587, Parent: 6578)

sh (PID: 6587, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6588, Parent: 6587)

grep (PID: 6588, Parent: 6587, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6589, Parent: 6578)

sh (PID: 6589, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6590, Parent: 6589)

grep (PID: 6590, Parent: 6589, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6591, Parent: 6578)

sh (PID: 6591, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6592, Parent: 6591)

grep (PID: 6592, Parent: 6591, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6593, Parent: 6578)

sh (PID: 6593, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6593)

grep (PID: 6594, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6595, Parent: 6578)

sh (PID: 6595, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6597, Parent: 6578)

sh (PID: 6597, Parent: 6578, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6598, Parent: 6597)

grep (PID: 6598, Parent: 6597, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6584, Parent: 1)

agetty (PID: 6584, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6600, Parent: 2038)

fusermount (PID: 6600, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6605, Parent: 1)

generate-config (PID: 6605, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6606, Parent: 6605)

pkill (PID: 6606, Parent: 6605, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6609, Parent: 1)

gdm-wait-for-drm (PID: 6609, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6615, Parent: 1)

gdm3 (PID: 6615, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6618, Parent: 6615)

plymouth (PID: 6618, Parent: 6615, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6628, Parent: 6615)

gdm-session-worker (PID: 6628, Parent: 6615, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6632, Parent: 6628)

gdm-wayland-session (PID: 6632, Parent: 6628, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6634, Parent: 6632)

dbus-daemon (PID: 6634, Parent: 6632, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6636, Parent: 6634)

dbus-daemon New Fork (PID: 6637, Parent: 6636)

false (PID: 6637, Parent: 6636, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6638, Parent: 6632)

dbus-run-session (PID: 6638, Parent: 6632, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6639, Parent: 6638)

dbus-daemon (PID: 6639, Parent: 6638, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6640, Parent: 6615)

Default (PID: 6640, Parent: 6615, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6641, Parent: 6615)

Default (PID: 6641, Parent: 6615, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6619, Parent: 1)

accounts-daemon (PID: 6619, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6623, Parent: 6619)

language-validate (PID: 6623, Parent: 6619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6624, Parent: 6623)

language-options (PID: 6624, Parent: 6623, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6625, Parent: 6624)

sh (PID: 6625, Parent: 6624, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6626, Parent: 6625)

locale (PID: 6626, Parent: 6625, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6627, Parent: 6625)

grep (PID: 6627, Parent: 6625, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6645, Parent: 1)

agetty (PID: 6645, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6646, Parent: 1)

rsyslogd (PID: 6646, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6651, Parent: 1)

dbus-daemon (PID: 6651, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6654, Parent: 1)

gpu-manager (PID: 6654, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6655, Parent: 6654)

sh (PID: 6655, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6716, Parent: 6655)

grep (PID: 6716, Parent: 6655, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6717, Parent: 6654)

sh (PID: 6717, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6719, Parent: 6717)

grep (PID: 6719, Parent: 6717, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6720, Parent: 6654)

sh (PID: 6720, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6721, Parent: 6720)

grep (PID: 6721, Parent: 6720, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6723, Parent: 6654)

sh (PID: 6723, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6724, Parent: 6723)

grep (PID: 6724, Parent: 6723, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6725, Parent: 6654)

sh (PID: 6725, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6726, Parent: 6725)

grep (PID: 6726, Parent: 6725, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6727, Parent: 6654)

sh (PID: 6727, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6728, Parent: 6727)

grep (PID: 6728, Parent: 6727, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6729, Parent: 6654)

sh (PID: 6729, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6730, Parent: 6729)

grep (PID: 6730, Parent: 6729, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6731, Parent: 6654)

sh (PID: 6731, Parent: 6654, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6732, Parent: 6731)

grep (PID: 6732, Parent: 6731, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6659, Parent: 1)

systemd-logind (PID: 6659, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6733, Parent: 1)

generate-config (PID: 6733, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6734, Parent: 6733)

pkill (PID: 6734, Parent: 6733, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6737, Parent: 1)

gdm-wait-for-drm (PID: 6737, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6741, Parent: 1)

rsyslogd (PID: 6741, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6742, Parent: 1)

dbus-daemon (PID: 6742, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6749, Parent: 1)

rsyslogd (PID: 6749, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6750, Parent: 1)

dbus-daemon (PID: 6750, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6754, Parent: 1)

journalctl (PID: 6754, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6755, Parent: 1)

systemd-journald (PID: 6755, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6758, Parent: 1)

systemd-logind (PID: 6758, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6819, Parent: 1)

dbus-daemon (PID: 6819, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6820, Parent: 1)

rsyslogd (PID: 6820, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6821, Parent: 1)

systemd-journald (PID: 6821, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6825, Parent: 1)

systemd-logind (PID: 6825, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6882, Parent: 1)

agetty (PID: 6882, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6883, Parent: 1)

gpu-manager (PID: 6883, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6887, Parent: 6883)

sh (PID: 6887, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6888, Parent: 6887)

grep (PID: 6888, Parent: 6887, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6889, Parent: 6883)

sh (PID: 6889, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6890, Parent: 6889)

grep (PID: 6890, Parent: 6889, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6891, Parent: 6883)

sh (PID: 6891, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6892, Parent: 6891)

grep (PID: 6892, Parent: 6891, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6893, Parent: 6883)

sh (PID: 6893, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6895, Parent: 6893)

grep (PID: 6895, Parent: 6893, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6896, Parent: 6883)

sh (PID: 6896, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6896)

grep (PID: 6898, Parent: 6896, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6899, Parent: 6883)

sh (PID: 6899, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6900, Parent: 6899)

grep (PID: 6900, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6903, Parent: 6883)

sh (PID: 6903, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6904, Parent: 6903)

grep (PID: 6904, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6905, Parent: 6883)

sh (PID: 6905, Parent: 6883, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6906, Parent: 6905)

grep (PID: 6906, Parent: 6905, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6907, Parent: 1)

generate-config (PID: 6907, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6908, Parent: 6907)

pkill (PID: 6908, Parent: 6907, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6911, Parent: 1)

gdm-wait-for-drm (PID: 6911, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6916, Parent: 1)

gdm3 (PID: 6916, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6919, Parent: 6916)

plymouth (PID: 6919, Parent: 6916, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6933, Parent: 6916)

gdm-session-worker (PID: 6933, Parent: 6916, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6939, Parent: 6933)

gdm-wayland-session (PID: 6939, Parent: 6933, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6941, Parent: 6939)

dbus-daemon (PID: 6941, Parent: 6939, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6943, Parent: 6941)

dbus-daemon New Fork (PID: 6944, Parent: 6943)

false (PID: 6944, Parent: 6943, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6945, Parent: 6939)

dbus-run-session (PID: 6945, Parent: 6939, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6946, Parent: 6945)

dbus-daemon (PID: 6946, Parent: 6945, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6947, Parent: 6916)

Default (PID: 6947, Parent: 6916, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6948, Parent: 6916)

Default (PID: 6948, Parent: 6916, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6920, Parent: 1)

accounts-daemon (PID: 6920, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6924, Parent: 6920)

language-validate (PID: 6924, Parent: 6920, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6925, Parent: 6924)

language-options (PID: 6925, Parent: 6924, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6926, Parent: 6925)

sh (PID: 6926, Parent: 6925, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6927, Parent: 6926)

locale (PID: 6927, Parent: 6926, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6928, Parent: 6926)

grep (PID: 6928, Parent: 6926, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6929, Parent: 1)

polkitd (PID: 6929, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6964, Parent: 1860)

dbus-daemon (PID: 6964, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6965, Parent: 1860)

pulseaudio (PID: 6965, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6966, Parent: 1)

rtkit-daemon (PID: 6966, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6970, Parent: 1)

dbus-daemon (PID: 6970, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6971, Parent: 1)

systemd-journald (PID: 6971, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6972, Parent: 1)

agetty (PID: 6972, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6975, Parent: 1)

systemd-logind (PID: 6975, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7001, Parent: 1)

rsyslogd (PID: 7001, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7034, Parent: 1)

dbus-daemon (PID: 7034, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7035, Parent: 1860)

pulseaudio (PID: 7035, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7036, Parent: 1)

rsyslogd (PID: 7036, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7040, Parent: 1)

gpu-manager (PID: 7040, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7044, Parent: 7040)

sh (PID: 7044, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7045, Parent: 7044)

grep (PID: 7045, Parent: 7044, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7046, Parent: 7040)

sh (PID: 7046, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7047, Parent: 7046)

grep (PID: 7047, Parent: 7046, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7049, Parent: 7040)

sh (PID: 7049, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7050, Parent: 7049)

grep (PID: 7050, Parent: 7049, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7051, Parent: 7040)

sh (PID: 7051, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7053, Parent: 7051)

grep (PID: 7053, Parent: 7051, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7056, Parent: 7040)

sh (PID: 7056, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7057, Parent: 7056)

grep (PID: 7057, Parent: 7056, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7064, Parent: 7040)

sh (PID: 7064, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7065, Parent: 7064)

grep (PID: 7065, Parent: 7064, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7066, Parent: 7040)

sh (PID: 7066, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7067, Parent: 7066)

grep (PID: 7067, Parent: 7066, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7068, Parent: 7040)

sh (PID: 7068, Parent: 7040, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7069, Parent: 7068)

grep (PID: 7069, Parent: 7068, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7054, Parent: 1)

rtkit-daemon (PID: 7054, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7060, Parent: 1)

polkitd (PID: 7060, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7072, Parent: 1)

generate-config (PID: 7072, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7073, Parent: 7072)

pkill (PID: 7073, Parent: 7072, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7076, Parent: 1860)

dbus-daemon (PID: 7076, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7079, Parent: 1)

gdm-wait-for-drm (PID: 7079, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7084, Parent: 1)

gdm3 (PID: 7084, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7087, Parent: 7084)

plymouth (PID: 7087, Parent: 7084, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7097, Parent: 7084)

gdm-session-worker (PID: 7097, Parent: 7084, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7105, Parent: 7097)

gdm-wayland-session (PID: 7105, Parent: 7097, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7107, Parent: 7105)

dbus-daemon (PID: 7107, Parent: 7105, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7111, Parent: 7107)

dbus-daemon New Fork (PID: 7112, Parent: 7111)

false (PID: 7112, Parent: 7111, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7113, Parent: 7105)

dbus-run-session (PID: 7113, Parent: 7105, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7114, Parent: 7113)

dbus-daemon (PID: 7114, Parent: 7113, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7116, Parent: 7084)

Default (PID: 7116, Parent: 7084, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7117, Parent: 7084)

Default (PID: 7117, Parent: 7084, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7088, Parent: 1)

accounts-daemon (PID: 7088, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7092, Parent: 7088)

language-validate (PID: 7092, Parent: 7088, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7093, Parent: 7092)

language-options (PID: 7093, Parent: 7092, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7094, Parent: 7093)

sh (PID: 7094, Parent: 7093, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7095, Parent: 7094)

locale (PID: 7095, Parent: 7094, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7096, Parent: 7094)

grep (PID: 7096, Parent: 7094, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7103, Parent: 1)

systemd (PID: 7103, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7108, Parent: 7103)

systemd New Fork (PID: 7109, Parent: 7108)

30-systemd-environment-d-generator (PID: 7109, Parent: 7108, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7118, Parent: 7103)

systemctl (PID: 7118, Parent: 7103, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7119, Parent: 7103)

pulseaudio (PID: 7119, Parent: 7103, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7124, Parent: 7103)

dbus-daemon (PID: 7124, Parent: 7103, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wkb86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wkb86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1596c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wkb86.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10398:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
wkb86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x6670:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
wkb86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xcb64:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
wkb86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9412:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
wkb86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
wkb86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x100f4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
wkb86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xe69e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
wkb86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x93e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6239.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1596c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10398:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x6670:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xcb64:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9412:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x100f4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xe69e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6239.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x93e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: wkb86.elf PID: 6239	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wkb86.elf PID: 6239	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x98f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xabb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6503)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6749)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6820)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 7036)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6482)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6615)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6634)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6755)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6821)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6916)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6941)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6971)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7084)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7107)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7114)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7103)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.201.dr, syslog.182.dr, syslog.43.dr, syslog.307.dr, syslog.132.dr, syslog.188.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38374
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: wkb86.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4500, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4507, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4511, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4532, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6129, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6400, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6401, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6501, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6644, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6645, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6815, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6501, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6882, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6901, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6902, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6916, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6965, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6986, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 7001, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4500, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4507, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4511, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 4532, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6129, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6400, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6401, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6501, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6644, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6645, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6815, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6501, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6882, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6901, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6902, result: no such process	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6916, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6965, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 6986, result: successful	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6241)	SIGKILL sent: pid: 7001, result: successful	Jump to behavior

Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: wkb86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: wkb86.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/162@73/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6490)	File: /proc/6490/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6600)	File: /proc/6600/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6634)	File: /proc/6634/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6651)	File: /proc/6651/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6742)	File: /proc/6742/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6750)	File: /proc/6750/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6819)	File: /proc/6819/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6941)	File: /proc/6941/mounts
Source: /usr/bin/dbus-daemon (PID: 6946)	File: /proc/6946/mounts
Source: /usr/bin/dbus-daemon (PID: 6964)	File: /proc/6964/mounts
Source: /usr/bin/dbus-daemon (PID: 7034)	File: /proc/7034/mounts
Source: /usr/bin/dbus-daemon (PID: 7076)	File: /proc/7076/mounts
Source: /usr/bin/dbus-daemon (PID: 7107)	File: /proc/7107/mounts
Source: /usr/bin/dbus-daemon (PID: 7114)	File: /proc/7114/mounts
Source: /usr/bin/dbus-daemon (PID: 7124)	File: /proc/7124/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:75463Rb1WOi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:75468TYnPNj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76503HDu2Ol	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:765112cSJSm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76517pB8wQi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76557axDick	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:765601ciEsj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76678WwuT4i	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:77845wurzlk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:77939PzZj3k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:77940ELjnSl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78028V2Ptgl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78130mqeFsj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78142a3ACKl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78191UVOVkl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78193iL6Opn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78230728kOk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78232WOvpvk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:783959O4Ajm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78428uhHMTm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:784458UkBik	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78458Yobb3k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:7849748Grkl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:785862hdehn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78664CMpqbm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78678Ai0kcj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78693d2wUCj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78841VoWaLk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/seats/.#seat0y8Ixoj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/users/.#127LcJS7h	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/users/.#127uXWjOi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/seats/.#seat0hvD3Ii	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/users/.#127JjPG7j	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6508)	File: /run/systemd/users/.#1278LmcXj	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6573)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6632)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6659)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6659)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6659)	File: /run/systemd/seats/.#seat0nHYR1G	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6758)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6758)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6758)	File: /run/systemd/seats/.#seat08rrKkb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80594nr7N4X
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80601MWM7qW
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:806027SUBF0
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80603ARBU8Z
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80616xObOgX
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80617paEUaY
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80618kgDSFY
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80619u4wIiY
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80704ON49v0
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80716UPOJlX
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80812F67FKY
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80857D3mR8V
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:8085946d9wW
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:80896orMcBY
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:81922jFbhRZ
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:81839wNJ1BW
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:81844JFGqUW
Source: /lib/systemd/systemd-journald (PID: 6821)	File: /run/systemd/journal/streams/.#9:81857EHqc0W
Source: /lib/systemd/systemd-logind (PID: 6825)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6825)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/seats/.#seat0MNwDvh
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#127FU8R0f
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#127lYYOGf
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/seats/.#seat0EL8Hhj
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#127UXhjgg
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#12775S85e
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#127Kiq5kf
Source: /lib/systemd/systemd-logind (PID: 6825)	File: /run/systemd/users/.#127qfdBYf
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6939)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6920)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6920)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6929)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393096et8pmi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393097v5F1Ej
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:3930983ZO6dk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393102qkB0ol
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393104vpCNwh
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393200bsTD7j
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:393201vkgvvi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1701889cfGFZi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1701890gvam9i
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:17018916IrkZk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1701892sK1VYi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1701893LbqSul
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702003tjg3hl
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702103JgXF0j
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702163QDNIbj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:17021654heXbj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702299pTzV6k
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702313GvD7Pj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702315Kg6yri
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702492VNqMgi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1702540Y5DCii
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:5579705gopnJj
Source: /lib/systemd/systemd-logind (PID: 6975)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6975)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/seats/.#seat0ULXDkB
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127vyiBED
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127CXfyBE
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/seats/.#seat0T1MpyB
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127x9JgTA
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#1279piJDB
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127pMZTYC
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#1274ZU6fA
Source: /usr/lib/policykit-1/polkitd (PID: 7060)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7105)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7088)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7088)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7103)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7109)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7088/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7054/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7035/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7034/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7037/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7103/cgroup

Source: /tmp/wkb86.elf (PID: 6400)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wkb86.elf (PID: 6901)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6579)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6587)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6589)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6591)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6597)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6625)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6655)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6717)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6720)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6723)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6725)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6727)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6729)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6731)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6887)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6889)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6891)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6893)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6896)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6899)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6905)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6926)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7044)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7046)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7049)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7051)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7056)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7064)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7066)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7068)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7094)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6580)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6586)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6588)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6590)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6592)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6598)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6627)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6716)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6719)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6721)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6724)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6728)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6730)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6732)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6888)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6890)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6892)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6895)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6900)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6904)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6906)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6928)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7045)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7047)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7050)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7053)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7057)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7065)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7067)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7069)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7096)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6606)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6734)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6908)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7073)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6401)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6902)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7118)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6401)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6902)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6755)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6821)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6971)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6584)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6645)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6882)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6972)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6615)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6615)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6916)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6916)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6920)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6920)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7084)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7084)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7088)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7088)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6578)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6654)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6741)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6749)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6820)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6820)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6883)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7036)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7036)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7040)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wkb86.elf (PID: 6240)

File: /tmp/wkb86.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6578)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6654)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6883)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7040)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6401)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6902)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6606)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6734)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6908)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6965)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7035)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7073)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7119)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6501)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6578)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6584)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6628)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6645)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6654)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6749)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6755)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6820)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6821)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6882)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6883)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6933)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6965)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6971)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6972)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7035)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7036)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7040)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7097)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7119)	Queries kernel information via 'uname':

Source: kern.log.43.dr	Binary or memory string: Dec 28 13:28:00 galassia kernel: [ 483.249083] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.307.dr	Binary or memory string: Dec 28 13:29:45 galassia kernel: [ 588.615398] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.43.dr	Binary or memory string: Dec 28 13:28:00 galassia kernel: [ 483.249064] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.307.dr	Binary or memory string: Dec 28 13:29:45 galassia kernel: [ 588.615424] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6920)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7088)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wkb86.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkb86.elf PID: 6239, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wkb86.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkb86.elf PID: 6239, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wkb86.elf	53%	Virustotal		Browse
wkb86.elf	49%	ReversingLabs	Linux.Backdoor.Mirai
wkb86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
wkb86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.153	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.201.dr, syslog.182.dr, syslog.43.dr, syslog.307.dr, syslog.132.dr, syslog.188.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	fnkea7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
raw.cardiacpure.ru	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
raw.cardiacpure.ru	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	fnkea7.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
CANONICAL-ASGB	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	nshkarm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	nshkmips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
INIT7CH	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	nshkmips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wlw68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6637/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6944/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7112/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mdJn:mj
MD5:	E780A0C850D9A64D226B62008EE3C40C
SHA1:	FE2A5EC854D6EF38F05CF3868B822E32DDDAB006
SHA-256:	240ADDB852C8F074025DB740C8180CC39B1A9DF96246FFED9E92B8A7F039DB3F
SHA-512:	FC7574904294364BF230AE899D3CBA42FEF13E88CCEAF263724911A17753205543E075CCCE2E93040136121574F4C8307609537D571BB67C0DACDEACA12C794C
Malicious:	false
Preview:	7084.

/run/systemd/journal/streams/.#9:1701889cfGFZi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3979096113193785
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7OQHECH/dD9grqjs1:SbFuFyLVIg1BG+f+MyS9H/B9uqjbVC
MD5:	BB796607AB717C1853BDDCCAD29CA995
SHA1:	CF2EA2760093120B153BC55FB6967723CC14A74D
SHA-256:	7C20981D2FC10BD667B03E353EC1E5BF2252B92285CEC572174A9D43923B249A
SHA-512:	6DCD67C627BA1458CFAE78693B897C203BBAD0C1B024FA5EABCB036C9CD3F1EE85149BBAE5F3D03D6F585889031ADB415AD24DEB947CE0A743174A1B2E8788F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17315ba6b8094bdeac7c8875a8fccae5.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:1701890gvam9i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.429876705448365
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmow1datWrTYTjswkCM:SbFuFyLVIg1BG+f+Mow1dasT0jLkGq
MD5:	EFF9DFDCC7ACC2FBDA09536187A328B9
SHA1:	C447414D2C36CED89851DC497070A5C68B00245C
SHA-256:	3181EE9D4E13113EA27421E5855DDB090A06058F4505E9F942BD9923FB728E9D
SHA-512:	6E1AE9E6CCD8972807A7E177FBF850679852986C59A0C3294FA1FF537B6870D4B7B4D3E642388C20577F6D45B213790E9B98D1F30FCDDB5D4F94C1592A6A7690
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b7f9818fcd9446a6853b092e9f982e06.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:17018916IrkZk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.406261858044565
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+gnmVVc0Mx8js2ALAXA:SbFuFyLVIg1BAf+M+4m/c0jjNALyAZD
MD5:	1E4E8E35046C6216A6A52F94F8511434
SHA1:	BF389F266EF63BF2C5150CDE030A026E844818EE
SHA-256:	32F0E40854B730F93EC6C38667834DA8AD7F610286BA704E62ECD97902E89291
SHA-512:	AE96CE28B8BC1A8E4885FBDCFD8D029FD5F77965FF102854FCF543E72D536C45B542455CA0505D3D1104245FB11D7AA95350F17EABE2A9C7BFF54ED4DC7800A9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=439ad455900b4ad9baf351d86efe5e98.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1701892sK1VYi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.346565173199281
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/DXWpuXWvNrqjs1Ha:SbFuFyLVIg1BG+f+Ma6mN2joa
MD5:	5F9CC5D174AC95760D70AD8880DEE14B
SHA1:	C5C600C95DD8948AC5910DDED1698742AE205528
SHA-256:	4090D7E7442A5B03F956826CAC4E5EFFBDAF29E57F31DBF0521AD0020A5117AF
SHA-512:	65B3F4EAD032EFD846AEB9D08CD95AB3FEC33AAB66D00E567B94CFAFD43AC371E8788C3C1C2B564ECAE276D732337292D252674360366BFE8FE891093FA1CD49
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c123a160dd840b1b45059504b23e564.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:1701893LbqSul

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.412937221767417
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MojpdrQKvsZjNdQIeXD:qgFq6g1af+MojpdEK0n2D
MD5:	C477328FD9708C279F90ADC0FA1F6B13
SHA1:	BE589D8BD8B76F622071E23EB6E168D99F8E3471
SHA-256:	3624C3DCAE7CECA1A5F12B545D7739AE0ABF589A607A41CECCC4E588368CD359
SHA-512:	FDBB11DE16A19C14491C0EBF4A21FAD3C3408D20C38F5194A2EB8E1C3AD9BC20B540F49E3CEB917064C3C2A9BBA2792209F4E2CDC237948CC6798502E3E0154F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d79eb0c80a74a70a50a0510f8181516.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1702003tjg3hl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.360408225689477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoGHWRbSc3QQClsjs2BP:SbFuFyLVIg1BAf+MoZzQQC2jNTZD
MD5:	80CE32B3907C0B6B7F100E735F99D632
SHA1:	D6A3D1383DF414149D7A8335BD826631E3D5DEDB
SHA-256:	01890E93EEBB95546BC628AE80A32F1280FC87CC9F6C4D419776B94E29870DB4
SHA-512:	A51C2643E285FC404E11B14FD4A5BE7E83CC6DC890E6B845D2D76E12A60BBBFA97E497F5AB1829279ACFE019996652E85D4D192BD42EE1559CE0D9140ACB801A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc6c93469a754d0cbb99c59db0b5a3d0.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1702103JgXF0j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.405667121188093
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu1KXHGzaTX0jLTTIWTIL:qgFq6g10+f+MbXHLTXUEWEL
MD5:	1F0B78E016E7A04D8065691A195261DB
SHA1:	8304C94FA5148A4D9EED5C05C2862A8EB7611706
SHA-256:	403399DFD3B3CC7B92A4B90DD1D0880CEAFC68DC6FADE7D61C502683E13CE9FF
SHA-512:	237514A82CA47AE6E5821BEACBABF631E1A792CAC245181D3C8F166F284916A85F67B06625F011DED9F7E67B62164D69982656B2553DEB741D377F47B467734D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de0eb40c6df2427597cefa2af6e667f2.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:1702163QDNIbj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.404459893620136
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm608l626DvsZjs2q:SbFuFyLVK6g7/+BG+f+M608MpsZjNq
MD5:	392D9FA3A3BB364C4A424383B39ACD78
SHA1:	3F04F3D09D27CF182994DD48C272BA4087B0D0FE
SHA-256:	4CD814C9B52F84E40B19ED05D397BBBCAA4AD907D8B1C2308B96713C41DC76A7
SHA-512:	CFF08A4F6E6A6A05EBDE0B0E443701C421368BC0FE1D32C7C7DAB87792735A52310BCC0FC97FFEF43D021D62F6D629F0AE2DC16857F1EAACE8E8DDC600E4B5C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e467d7847334e29b8a63d07986ce23f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:17021654heXbj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.429488532190577
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpnpEFaSAUFYgrqQ:SbFuFyLVI6g7/+BG+f+MBpEmUFYuqjNq
MD5:	ADE702E8E85CB37EF2F5D079ABC4487F
SHA1:	277004002A6FB25B0193F65986391ADB471BF0C8
SHA-256:	794E2696B4A9BF697B092F0526BBCB40DCBD7F30FB1C4B6BD32D942A75102EFA
SHA-512:	FFBBDA34E2244F4B2C5478DA6F4A494C3604052C02AB55B825E200A48C11FCE49BF8973149EDB998CF58A19EC7A464B957C2E91C553EB4003DAB9D00A61FC4E3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3da6287c7594611aa20f7f4e585e155.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:1702299pTzV6k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.439558119321071
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M68oWN7rDkS/8jZcHBrt:qgFq6g10+f+MTNnDkSymBB
MD5:	EDE7A474836F656CA8F8B46A24D55D73
SHA1:	4F0AB8F2EFA0D589B4957032EB0DECEF1FA8A49E
SHA-256:	6F2F8C1CE228E7A60618C22C06DCBED631AAC7641C95BF366A490DE924EB40BA
SHA-512:	9ACE96B318F62F62BC361D2DD9073A028FC5A00A755928D9DC34BA420CA128F21537A1C835E4ACAF417F7E4FA224EC571AC8C4651A87273A0F3DB6D6691B04C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=04900bd963c543ebbb75bd8539fb7572.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:1702313GvD7Pj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.551916675103126
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mfad5uqjFQMzKaBu:qgFqo6g7/+0+f+MfaHu4Tmh
MD5:	52291F02D482954257C4609599F4C468
SHA1:	22CCF73475D4D063E4E9EB58E49E30669F74EAE9
SHA-256:	589584D0828B08501F9347EE17F3CFBA07B091FC25FB633DE059D553C359B7B2
SHA-512:	31982EAE10956CEA55D0D9EE4E7C094CF53E5E0CD8B74EB07FB71A3F53B7C0D58EFCEA8DA5143E2EA118018D838A8BCD61AC53F6B4FAAB1635239056442DE02F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=597d131189c24d509fc857522320396c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1702315Kg6yri

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.501135130403459
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MM5X0jFQMzKaBu:qgFqdg7/+0+f+Mo+Tmh
MD5:	A596DDE0DE2419846144CD9AF1282FE6
SHA1:	C170E300226C11C158346E78242AA2FF55A8193F
SHA-256:	E8646BDEEB9ECDA9197A77B68FC84C9ADF5EAD96CE5D619F5FC8998125F2F6F3
SHA-512:	A6C5FF53347AF8539C08DE967A2B1BEF398A5FDFD61CE8FD0466CEEBB5E0080DD13C79C271249AC54F7DC18AC9914E5D6BFDD0EB6E26EA6751864E865CF2320C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a32bed9a5b354f8eaea9f7997984b112.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1702492VNqMgi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.346264043067947
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpXHgVXG3GwWN622jK:SbFuFyLVIg1BG+f+M5Q22wWNCjZcHjv
MD5:	079BC60A731877E6FF1474616B521255
SHA1:	4F6C19E2CB3362C39FE8C4EB272B217A8C5FA399
SHA-256:	3C037543F5AAADB406D61C4AD97AA05B58EFDF2FD3AE0E7981BF1F1BBF7179BF
SHA-512:	085C9F37598EB75ADA49F37B97D0C8CF7164CA3DB369DB20C1145A384C81E88F50272322F8397C4E0E119710576DE25137AC67B3C57DD9741D7E98D995A36AD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c2bb4c015cdc4dc9b5cb59be3bf606c7.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:1702540Y5DCii

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3522100593464526
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzaZmfHHQbQo2s2rxm:SbFuFyLVIg1BG+f+MlHTo2FrqjtWL0
MD5:	6A650710A295701DA3EFA35619B2D5C9
SHA1:	BBD1721AFB3D468E9674FED12809E392C7A3FB6D
SHA-256:	56B5F9CB7D2660588CEC003D4C72971782E3A02E8397F7949B5D1AA34CECF30D
SHA-512:	BAC965AB7B0F4F1C1015E72550DC4FC0D88AA69B251A31310F7484BBD0EA0AAB176240554AF75FE912D661D285AE2796899C4732D8B4F1228B59E210ECC058AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f6e7c060bc64c5dbb5fbce951f9ca41.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:393096et8pmi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.391835248917354
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoE1cNH21PAzGe8jsc:SbFuFyLVIg1BG+f+Mo5121PAzG9josQu
MD5:	1F56BB318B6C790824F204633BB01BE5
SHA1:	ABB63B4B9DCACB94B22EE40F7B5110AE6BDEC8F7
SHA-256:	57141DB558889338545D4F4E689361A970F2007E9F994E1A54DC3F44B6A94F82
SHA-512:	96DDD373F69924DD695075F002A568BC1301C0C25935530CC1A054BEE2CE88F0F36C4B0DD46406C5A7FEFC39B71F74C7E908A8002198E20639EE5600D5510651
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba0229a9b42d41808e5b7925aadb3c59.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:393097v5F1Ej

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.51600984029649
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+McXwEYPATjZcHcljX+:qgFq6g10+f+McA/4RmAu
MD5:	D38AF9ECEED4BDEEFD1FE09B21AAD61A
SHA1:	565EDACDE4611AE547EB04381610D69878DE1117
SHA-256:	18C94D20E8D73CE7148E3D10214DA37CF3E732AAB868F8499507CDE6B88B6856
SHA-512:	2CFD006C4DED5BEF8EE3BF4B9EC6240FD9249F5772F55368BF68881DC7C4222CB864FF9B01431D4396D86A1A69D51A07457827BD8BB82FF9D9C388B7A752BD90
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb7264f718454f659d37acee05a1261b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:3930983ZO6dk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370710808878859
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz+ckEkxJTpsjsmNzi:SbFuFyLVIg1BG+f+MyEkxojdCLKzK
MD5:	BC06E6FD5D858F61E857573DF0838E27
SHA1:	7FCA2E929654CC05F6CD3CCFD8171A1CF237BFD6
SHA-256:	A0F7944DE4981F7DCE08EB6FE8DBB17C69383BDEFBA867007C52ACC6245AA0CB
SHA-512:	791D16C77853A4D79B7898623A67EEBCCCABD3D686E8DD06FDD81AFB948D2E727B0FCE48C7EE67C20BC2F2F18363F511FEAAF9D4A87B74DFCF27C94B9D44BD17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b2ab6516e6e4a8bbbf9bcc2a3d61e5c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:393102qkB0ol

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.379714565877087
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu/H2RTpshuxsjs1Ha:SbFuFyLVIg1BG+f+MusChuqjosQu
MD5:	21763544B18B2ECF05BA613C94E61DF7
SHA1:	3178313BCAE5AA444F84E815FBF10CAD11173327
SHA-256:	91EC4060CD193553F8A4B5E684AC53ABF4130DDD3B5C108378241D1F4CBF4369
SHA-512:	575ACB960DFE3594F80F03C1E8E4A8BFD12985228651264D9347BF4A680FCEA25EDDCC59786692B628170358CC2ACCF88183E04937677FD2779B86CBEBEC0E9E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dcc06c4fc3ab408dbe7746303ca0d961.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:393104vpCNwh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.264496096603511
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4BjxHjLJSW0MxsjsO:SbFuFyLVIg1BG+f+M4BFXJSW0MqjtWL0
MD5:	567D6C8943186DECB545036C4B6CFDAE
SHA1:	FDEFB8323C98150F19B08E17B2DB0087AD8653CD
SHA-256:	5FCABAFF46621DFB5B7F3E4698B03F49F43C6AC6614C7503452A682DBB41FD19
SHA-512:	2F2C4A8DE2F1E017226B147CB6F5A9B19527981149DD60F824D3432CEB4FA045BB0682AB6EE7C8E1A1955A8F6406B5F22CEEE53A62FF615325638FDEB76918E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2de4aee9ead34595ae1a4c15770097a3.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:393200bsTD7j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370898789731299
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvsGXgyHPRjt0huxsS:SbFuFyLVIg1BG+f+MEOZpjujdCLKzK
MD5:	9BBF34D7F5F393085C965999422037ED
SHA1:	FF71B260ACF2F7F9BAAA9BBED63099B95395CECA
SHA-256:	7ED1C779622F3D9055B3E81326FF93BC85CA1E782A0707B060E175299A63A611
SHA-512:	35CE5D2DF623AE004F8F034741ED1154665E365FEAB1378F0E199BE00D948FE07C239C38C49000072907EBCC05C3B0BC037AAF15804D52F3905B22E7B352C6C3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e0fd7b75c8094da4ab0eb24a6f74750b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:393201vkgvvi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.403399002444995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+k3Oo1eG6hTjsjOdy:SbFuFyLVIg1BG+f+M+i1e5ZjNE
MD5:	D912CCE8128DD934677EA4BE95165127
SHA1:	61FECD1043A7B0909C5D80A35C7C782300B183F5
SHA-256:	5B7D147257F294A5E5ECFDA368DF00CE38972F47FF397855A70062FFCB86C86F
SHA-512:	F2FFC02F1EC81559D695EBBC83379406DB6B2A3CFA759594E5CCEE28D492783040906E5CC48E09EEB18B9CCDE655618370DA96B894D6173A9A54B52D3B6A01DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=429cd3d0812948689e0b0e1c9eca1895.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:5579705gopnJj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.328966990685469
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvD6iwyNWdWxv8js16:SbFuFyLVIg1BG+f+MuijAA8joa
MD5:	286853DB634A3C6932429681B9678D17
SHA1:	1422710E9579D79639F9E8FDB8C5F0898C93C08F
SHA-256:	8B68C8C1368CCEE3AA8A47F0087AE12DE75553A7B2F4835210F1D54130BB32E2
SHA-512:	8D63B2E1F68C22C30DFCF52455CCF4C65F986D7444D05B8E22E05EAA6CB417A998767613CB74A90C46027F325DCCE127BB0F7B75B0F7E2E5E1FE50F5ECE418B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e443d05cb5e1481a9da15d6232aa308d.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:75463Rb1WOi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.533496214343009
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4edhc8SilcZURqjsv:SbFuFyLVIg1BG+f+M40rSrU8ji4s
MD5:	BB6C85738E1B3B7DCB949CE2A2E68FC4
SHA1:	95F24964E4E31BF189D8D890A069DECCDF89FA5E
SHA-256:	C1F57FB36D9CB2B6BD42C9625B171EF210F0ECC5B34EE1E2D539BC44458D250D
SHA-512:	984C7380C1510B9C8CE1367F1E253E074FF17AD2D3F3E02DBC072C8C87D96F8029554E52B8F48D08A4443D1E963FA28E57C7C5915296A43FEDD91BD37BF8B19B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2722877937524e229499714d69be30af.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75468TYnPNj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.546817429021874
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+jkjFYlYglsjs7Lbr:SbFuFyLVIg1BG+f+M+Ij+2ji4s
MD5:	16E0B2F670013FD914F6B67CD7C17FEF
SHA1:	0A1E4624C244C8AC31A3C3AA157BDB9EF2C6472C
SHA-256:	577117A8E262AA8CA32658A0D7298E6C32AF07296009B022496D0BFC73775B7A
SHA-512:	63DAA37CA277206FA147DFAC503057D0F24785C920F2FE59D3E6AAA77596247A0274F4634E6204B1BAF1F709AF5F9673981472950438B32D0E0C28C2E87757DF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4bfb189727554e06b6bce32a140def21.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76503HDu2Ol

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4363288653134765
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyg3OfBNRvshuqjs16:SbFuFyLVIg1BG+f+Myg3OpNJATjosQu
MD5:	EF23BEF397BA0E818A132A8EEA429E76
SHA1:	FDE16246837AD299021FEFB480120E9C7F385414
SHA-256:	E40E9B73CDDBECF158059D74D58E51CD63194492DF7C2CB0E4AFDE3109CCED65
SHA-512:	BBA54C931BCEE80E7213BAB11FFBE5B1987014557B20E7D718E7266BC66D1F692D5721CC1894C965EEA56334F39910D970030214FA1C821923C1014B5EE50A0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=84c7a19cc8584d219d08ac328fe9af64.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:765112cSJSm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.413002787158329
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MYPQ+BeM4TjdCLKzK:qgFq6g10+f+M8oVCLAK
MD5:	D5F221BE653531DFE4058A3EBA5902F4
SHA1:	638F5EA7E79DBBA2FD7A0F94BC3F8341055776C2
SHA-256:	8AA37815467E5933970D84AA2212D2EBECFD8647151D307DFC18AD16017D7837
SHA-512:	637ED04881FCAE6C37B854FA295BC57CC2FB0D25C3D50979024EDFBF5C38A875C1589183B0054B88C01509D9ADF619B6208AD379C29EAD682A1CD312694E16A7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b5136f038224b728f04273a56dfb848.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76517pB8wQi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.363587535343356
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4WBy5diGTrjSXH2rQ:SbFuFyLVIg1BG+f+M4W0lTHSXWrqjtWQ
MD5:	9C58A64BF08FCB031F896963C0C8FA56
SHA1:	6B69BC7EC5A00A1B08318D528D57BB83470A5EA2
SHA-256:	95F30C56385295F242007E2D2720E02A5D6FDD3C5E1A3B5FD9DF1A2F707B5A9E
SHA-512:	A8F8BF23BD39A1F451C1D1067B32846C2E278EFE0401B85C594DBD42EBB097BBD9E392F86AF17236AB92F9A24EA79F2F9C9FD6B0C094A4B06B86914418A960CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=281e1b0906214da1a96c6df6fa975725.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76557axDick

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.407162470001971
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuvB5UJRU3R8vsMxsO:SbFuFyLVIg1BG+f+MuvTUch+sZjNE
MD5:	79C9781CCFD62C4E4E4D542ACD7766EB
SHA1:	F686DEC9BD35A71FCEAD5210E019208F2479E638
SHA-256:	3F68AAFA0A66C000091DBE672CFB793F48B4391CEE193123E4A5ECE44EB975CD
SHA-512:	6AB0D923697B30027915198F764DE5E071A708D9EEC12530D16C5997543512586667CED181910D07144CA4328509239BF17AA5FC336FF30C0BE0FDFE5DBCF7B1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3056da1337a4d1b8e2504c4fd6cc4a0.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:765601ciEsj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.47511682928581
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MV2YBmuqjZcHcljX+:qgFq6g10+f+MUYBmukmAu
MD5:	15394004DCE29B950F4D4613980AB8EB
SHA1:	16695D4DC1E8AF99A1486049BD76997A550572F9
SHA-256:	5C068B22B823C99F0708DD9F3FCB67A1CB6661B3CBD1FCDA755A843AF677BD62
SHA-512:	B6111F91A969DF1968E7FD3E837C85D69B8C947A0EAFB403861CB59F93475171FF0741B6287F556BC41B8407F65F1317E836CB7828599A272FD2EF780F65E203
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5781a008c5f4b478c459ed377dfec19.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76678WwuT4i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.418396103710695
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmye2Fc88TsYTjshKJg:SbFuFyLVIg1BG+f+MyetsYTjbVC
MD5:	40E3E29F1911DCB8186245017618A4AE
SHA1:	F5C4BC2D475620A8CE2A27BA46D5C4BAD89A1805
SHA-256:	BBA2F2F932FFE4CBB35E1485F05668CD8923BF281513777F8D25C05D6B5DA87E
SHA-512:	7C776041BA6CC682A58631AADD00541E5E81DFCECE21FCD450D681C2EDA371D6137FAB12A45B5AB4FE1D12665E5619ED7C080B47CFFC482A82995CADD3384AC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8bc9186091954312b6a43f064454a854.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77845wurzlk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.415000919776087
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+EAVxpzcAddoAgrxsj+:SbFuFyLVIg1BAf+M+E0NgrqjNALyAZD
MD5:	05C2D39A1E792D973C36872AB411FF5E
SHA1:	CFDAA5A9A83C1B8C8DE9FF0B9D7ABD3875AD71AA
SHA-256:	A08907C3D38D4E7B76561B94BA564DD891B25CBAEE710F03CCD663F14D02F845
SHA-512:	38BA247AD7FB58D30A3B2BE3064AC244FFEDF22D3EFF4A2C2C08E880C7C7816724A60BD791C8DFDE2820AD7AAE8E8CFD5C92FE2BB372CAE067D48ADCEFC8639C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4f2aba1eca9e425f81b8740da409e883.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77939PzZj3k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.419469027388842
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpBQgFTfScjj9R8Tj+:SbFuFyLVIg1BG+f+MrQqT6MjgTjLkGq
MD5:	CCDCEA8F5E26ED069D94F1C1B4517731
SHA1:	ECDEF12D264DED74FAC7B7B54C0FDD6BE59A36CC
SHA-256:	D03D4E2A9A826C052694AC8D56BA363C4E04B6B172226D35FBC60B6A222CC93A
SHA-512:	0164DF40BD95CB0F8D6A76E86193BF21B48118CE3082BFA08FB5D71D3A9EB901D2DC9B9FBA20210F98C6464D484694994701AAB2F8D5CB5795B0782C7020D2C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd3a574f8b674927901e6ce4e175d40d.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77940ELjnSl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.415925634688705
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6BtY0MMYg2js2BbQIeT:SbFuFyLVIg1BAf+M67Y0zYg2jNdQIeXD
MD5:	4ABD37AE99A06804F42BD59FB4D6BAA5
SHA1:	27B98391B8A64D13954E11E9013036E38BE8E5EE
SHA-256:	16B7D360FE648DF061461E69D0BB2965FCD0B77803C16C84B89D515AE767F3C4
SHA-512:	7D118AAB9849220BE27244ECDC9CFCB9E494C331A0277FE0AFD7651F16465E66449DAC09B1244C0B78EECFEA3081D04500C51137E8EC921CEEDD0E79C3B0C273
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0b3aae6a8c5e425ab1f5215baa2bfe6e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78028V2Ptgl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.460963011981554
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsWRhW5qjdCt/rRMtq:qgFq6g10+f+MsWRAmCDL
MD5:	34AEB4CCBF5FBE36C695D8915E0BFBCF
SHA1:	4073DAA6FBB1952F527D6F0F161073ACAE199642
SHA-256:	CEB798CD9BAD09A1177CC03AE2B06113058F2758F795DC99A93FBBF2D2FF2F6C
SHA-512:	75DDFF5A4E7FDA9BAF602612BEA8DA16139615751A3243956438464229D8AEAC06FB9A81462A7768994860FD2FBC4E886D132A110BB8AEBC9BA57AE9938D99C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f691215ce2004b14b0cf6ccaf750d733.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78130mqeFsj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.394854220525023
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpscplRwcWwhSDpjs2BP:SbFuFyLVIg1BAf+MjH62GjNTZD
MD5:	8A854C43D9E1F52228EAE1AE8F79D579
SHA1:	6768E796DBE1B6F6D4B510E6B2834DD600FA2D45
SHA-256:	95934484EE450A2CE293307BE3DB74508B043447040E78BB53FC46834EA2561B
SHA-512:	AD4940DDD1DFF3286AF88CAB1F55AED9B1AD89D1F8B41CC85B8290ADEAED949EDCCBE701B86BDF6ABD3D84622743604CF8BD4277145E9C174476945247B15145
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c004c1790f9142b79be89347f98417fe.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78142a3ACKl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.447761616539203
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsmrDomjN2jLTTIWTIL:qgFq6g10+f+MsADoK6EWEL
MD5:	B9E80D68AA7A1A82253FCA8106F663A2
SHA1:	A118722354603EB53DDB633D630C0E27F0CDDD38
SHA-256:	5E81CBEF7D5BA35B498377616D2981A76E7453662195367DBFA9EEA3D404E0FD
SHA-512:	8641E96AA14D13AC8CF1526D9A694F6736D0AF9287822AF29AADB1F2022A2E7A100BD7E7BBC984487801E18AB34C0599BD12D3FE9572F679AD8C77B59FE1149A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f68da03cb1064af78b7f66e92627dfb9.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78191UVOVkl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.410332955300785
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4sdDGPry9qjNq:qgFqo6g7/+0+f+M4PO9wq
MD5:	4B8E79EEAECD26D22B807173BC47AA96
SHA1:	319914ECADF9369FB35E8972B66F037754373C2E
SHA-256:	70B1C98D9F74447C67B48CEDD9CD1E77B404A9DC30B332DBA1F713DBC486511E
SHA-512:	ECC4FAC3FB4347BEC1C67D12DCD79863F908D9A1B053723BA56FE72B2C30E2448BAB3E8C89971D198EC3CE974F0C2989A4EE9A6E1655BA092CCB6BC42A1D4255
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20c80cb9a20c4fac8ac61f6011974e39.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78193iL6Opn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.407700583085517
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6AydFYjzEZFlsjk:SbFuFyLVI6g7/+BG+f+M6AxQqjNq
MD5:	B145A8E8D1CCD2E49A66F49F72732219
SHA1:	6751DB989835BB7318391A02E7C2C0737E1677AF
SHA-256:	49F375C83C3DF6C3ECCED81EF85382B96408E2B4E65445AB3B162793695BB82C
SHA-512:	65DEE0A717A3A61EEAA9F878C9F178AF65140734E5704A50764463F79F19F6839975E96E752899C2B86C9C82FEEB16C350E4BE87186F44C99AAE15C9BE384276
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c2a80207337473bb1d259ec0c718e1b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78230728kOk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.549306763642922
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8mlhBH/ZjFQMzKaBu:qgFqo6g7/+0+f+M80XTmh
MD5:	ECF04C71BEA456788C20577D640170D7
SHA1:	61F9C21C249563DEECDDF7DC2F777F8E8C120FFB
SHA-256:	18FE383E258662E5F70935E67A3289B7F07BD9C29B6347DB46EE0382D31E7523
SHA-512:	6A5EA12E860C3010EC23436C7479B3FB5FB2194880E66781842693326F16AA7DDF468206C4250A237FFDF592264D96E6AD88D49A20C36A1281036CEEBF36A4C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c973874f13c4a0d8309620f1cbf45bd.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78232WOvpvk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5180146966328225
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mlpnn9ZjFQMzKaBu:qgFqdg7/+0+f+MljvTmh
MD5:	E30B52347553ABB7FA2949D3438D8E31
SHA1:	B2AE74C5E93C5E6C6837A961692AC7AA89AF56BD
SHA-256:	F2C77FEC2F466C9C4D17182691DF1309966855150B17A20D0F1943587C84076E
SHA-512:	81654C05213CAB8F785DF759E43D41601114A9A9DC6025D2E3A575BFA320DDFC54792A2CB9590889DEF5FA0A3D4FC43BC1C4E23EE09145569A961DDD887166EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a6c7d93e89fe4677868e0acb22d4fc2f.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:783959O4Ajm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4082890852768575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8FEjX1mzAKSHZDGs8:SbFuFyLVIg1BG+f+M8+RGsHE8jdCLKzK
MD5:	DE566B0F6A7B27D08F3489552F31EEB6
SHA1:	1DBD55B8FE31CCB473637F9227F8AD6FCAAFC416
SHA-256:	B503B0F5BF050FBB5425E08C74338B551BB9D2BEC82F28B93EA6319806E646F3
SHA-512:	627FC750E76EACD2CB16D80BD5A5DE79452A24643E58D8DA4D42F8762A2D409662D7DF4CCFE5DA17E2BCEC92DD26460B37C01DA90B9C001D773F725EC039607E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6875ada7027c436cbbee16599b7c6f18.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78428uhHMTm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3787616359976465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+a1XnDTWQpphSTjsV:SbFuFyLVIg1BG+f+M+a1XnDVYjLkGq
MD5:	EF887BD91907EC12D54D8EC2BED7A6E2
SHA1:	E45440513021076AD806CDB959FF324DCF4C273F
SHA-256:	64EAFABC55F30FB814B6BAA12E41CD85FE29BBB55ECD4CE078024AF389EDD824
SHA-512:	DDFDBD97106D1ED83DCDD065C616C00F973A140E682A56E92A63D1CE6DD111D7FDB50816E22927F152C2EF90CF55EE8F3779123801123211B4C15EDE34CD9F4C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4138e9a2f84f41e3a0351c0fd009571d.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:784458UkBik

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.43896414320313
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4OH16UHCDTjs1Had9:SbFuFyLVIg1BG+f+M4w6UHCDTjosQu
MD5:	0D2440D830C4FE016F14252E498A1D1A
SHA1:	A6B0673CB79BA5DF4041962DBA39C0ABBE19AEE3
SHA-256:	86E8B17E90CC67526EF847C06F45337DCD70A823D88300C7A75D3B7ED6BBFE05
SHA-512:	096955A943B8F0BE84C1C7F926645ED9C6D3082D9137F2EA8888CCD73D8A9567961B3432B8F50CB0F41513D36E4104E9ADAE8FC7F0E37ABD6EACE1992750CD52
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2160a4b96e8a46078373806c0945bfef.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78458Yobb3k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.384747753775705
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/3caR0E1X1OGG2swV:SbFuFyLVIg1BG+f+MPNR0+pGFjdCLKzK
MD5:	9BAF9380968526F3560232BDAB19DBA1
SHA1:	4EAFC3514BFC8A8769EB3C130E056D530AAC194A
SHA-256:	B5E56F37E601A41828C61D36FEF0B88D2A824816D655EA5F3CF5A5F9DDE925AB
SHA-512:	C6C3507D50B69AE8ED2C88E9D0BB6AB7E31589BAFFE1E8F23B834F711C280DFD8E561A74D43E443130EE710EA78DBA7BA4FBA4B80995638071D6E71FE7A2551D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5dd4a5fff9764f4a854a956ee5362cc1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:7849748Grkl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.471390378974745
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr36ENJ7aAtCTjsicN:SbFuFyLVIg1BG+f+MmqXCTjZcHcljX+
MD5:	8A74335A821EABB131C58EB41D0DC1C1
SHA1:	D0DD8792FA2B9DC1CE45F28AC4314CA39FA6D3A3
SHA-256:	280673BBA2022D5E3F6A3140E5F862E7783D700BC6823FCCD375D3A6F379A531
SHA-512:	CA3978D9D7059136C3A64A12D96BF8CB91C6DA6567085FA88746B7965005FE6438918054937921134804806E0A09A97CB34689A0C21F28B804984855D0131BDC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ab22752dae71453886de77c60463e0b4.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:785862hdehn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.412942807844992
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4ADM0McyCrqjNALyAZD:qgFq6g1af+M4j0dfrwIZD
MD5:	0C98AD7E7EA7C4CE7B1ED23707ABB2E6
SHA1:	6B3DC853978981A0C041FF7EFC8B4DCA788602C4
SHA-256:	7164563A91891E6A6A48283E5C3CBB60E8BBC043A5AE065D6C2F8C97AFE59487
SHA-512:	B1B82CB4B1CF7E511B65E50E5EE8434D2FD48139CA9BDBF4364C39929688FDA4133D6B45306B62886FE9733004555CD9B9854C454E78A5B4EC0165EA36A7508F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=274f039f78fe477a9f09fab5f9daac83.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78664CMpqbm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.42182017428366
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MmGlPtYH+4jNdQIeXD:qgFq6g1af+MmGlVq+62D
MD5:	12676035B52FD412CB1D259B11A3EBA9
SHA1:	2FFB2448BAA588A606FBE10FF951AB61A487002D
SHA-256:	816BC71B75EA2C0F2CF6BA980FA00E77F9CDD98A451326655405240EE573749A
SHA-512:	CAA49D3D02952F3DC24C6B067010F4D8ACAE861B52086DFFF3CDF1405E03F0E003BF6E4EF8570C10182E23AC1CCC6432E138814D68584FE9638E33AA9A3FDA14
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca87adec0b9d4a9eb1a59dcc34c8b01f.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78678Ai0kcj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.442141756704154
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvOAsItR5js1HadmQ9:SbFuFyLVIg1BG+f+MGAZ/5josQu
MD5:	4334D294630BF1740D07ABC9DC6017FE
SHA1:	C12FCE6FA677E11E59B433CE519469297CBD9C4A
SHA-256:	CC1AD52390A13082753C6835D6E18444E082ECD44D3204A563AF3C92463B30D3
SHA-512:	B4C43C08B09ED3DEB7B840E56A8057B81946DDB59716E70DDD02D1390C297202BFE3F0F224DE0ACFF3927E5A732A7FDDE99E3AD726F6FE4B696C968ABA2BD9CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e01f4897cced4016838c599c93f776a5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78693d2wUCj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.39436313839109
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ZryRG3lcUonR1sje:SbFuFyLVIg1BG+f+MzuRG3ORmjdCLKzK
MD5:	93C9F3B45FAD8E3701050E73DF0DA957
SHA1:	E9385C053FD635915B8294904BCE4F38C7090189
SHA-256:	7DA470362D840A25260A8E8E2758AA05BC87F090084B282B35BF46F537ED707E
SHA-512:	EF5EF5E14AD3CD32C2E6767989DAA2BA23F4C4849067C99B07D71C77840108A5E3CC493E593283D8E48F09D1EE0C541B004F5BB32AEC96451FA6DFA8070AEC34
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7c43f6d8e4594c44b87595df6b43d440.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78841VoWaLk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.420841679799684
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv3M5cJvWHZjs1Had9:SbFuFyLVIg1BG+f+MPMCJvkjosQu
MD5:	BFFD5CB665D07078B08E9DC31FFAFFFC
SHA1:	ADEFAEFC3BD01978F437767B98EC42F91AE9F3AB
SHA-256:	F09E9B9B00BC351F43AA95690F10C3DF6DF1CCA7E93CDA3549D4EFE522C0C5E5
SHA-512:	026D8BD3BA9FBBBE18DDC06EECC05351445393170C89DD320E7E0F804860C0F9D855BE044F61374BE3129040D1A7F3203F454AF43F1B20FEF32AD46E804066C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e80f8434a48540579fef9641308ac5f5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80594nr7N4X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.521026622185491
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6p//6jRqjs7Lbgwzj:SbFuFyLVIg1BG+f+M6pKjRqji4s
MD5:	E121FC4D5931559E6FBA13267C657806
SHA1:	ABC31083CCDAF1639909F8D1F851FDDC631BF5AE
SHA-256:	82C85483645BA4F13B44D84213C8D1F80AB76671F34DFAF5761007CB39BCD363
SHA-512:	C02907C53FE51C491FD5DACF6431695DD6338FA1639A3EF038BB18350B308F6DD2A9C8E7281834DA7A30518DAEFFB5E8267FF45BC341016C8BD95C98EE6777AA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03d9827b37f541d98bc7058a5050ebe5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80601MWM7qW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.437937534630887
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoHR8ATSYTjZcHcljX+:qgFq6g10+f+MoHbhmAu
MD5:	AB66B5E8136FBD0CF5A459F36900AC32
SHA1:	3055071423726857D7F5F17F64E12A1591E2FFF0
SHA-256:	A22772BB7240D8FC5643CC841A89C03762BF35CDB045A3D78C9D322C3AC030A7
SHA-512:	F99DC0ABBB41BB37DA0C7ADC4D3444E1D20C0FD0B1AA4234B7DCE49F820E00B6C77209A5CD900BF4E71C531518EE5CCD43888E717769EAC2737FBFEB4FB4585A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bed83a32d7f34eee8c4c0d088e606654.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:806027SUBF0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.378606876665045
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzLTTmWLV1MTmsjsmM:SbFuFyLVIg1BG+f+MrTX0jdCLKzK
MD5:	CA6EFB369FC88198C1C52E678878E0CE
SHA1:	F9A10F0AE31A9B5AFD027D775F96C6D65A1960CB
SHA-256:	7182D63193C4067708413B12BFFB99699DF58062381878FD0FF2CFDF28370701
SHA-512:	00171BEC7A297027ABF140A113E526C1F13E8D4AF21368A0C479252443D243505167CF824438F8EED5EBDCCAE0BD1D286FDC3FACA35A5D6404BF099086D20DDD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=96b6bb67eb74478f8ed2cc90467cc6ab.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80603ARBU8Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.413638691342366
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+ALxxcBFJv8josQu:qgFq6g10+f+MTTcBFhaQu
MD5:	729FD4AA057802E8708F70CF47C2F21D
SHA1:	6C48C11C78233F641519F5160C0480622B27DA83
SHA-256:	B90EF8A07E409B490363DE6EE6724D066CD3E469B54E50901BC606DC5686E23E
SHA-512:	CF7C07C79E6AA11AEE168EC1F443BADE516E57E5FDB9A4E73B92A413E612A30F06C7153BBEA09A03EF5FA6E1E52F77D29E489A99C1280DF003685D322E5D730E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4dea6c6dfcea419785ad8f429d8b49a4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80616xObOgX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.416581190383185
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6DQ3UkR1+v8jsicWg:SbFuFyLVIg1BG+f+M6OfDrjZcHcljX+
MD5:	7FC7453CE285C9E678EB9E752C1359DD
SHA1:	A77C2FD0B1D24F5195D39782EB032EBAEF0D220C
SHA-256:	FD9F6AA6D6A42A458D51F647AE8A97BEA778B98E86C0F86F2BDCC315A2BEDA34
SHA-512:	5535A4AB31BE2096C3401ED19AA4C72A1F6A0169BE4F7C4F50BC7C147A4D622F94112ACF5CB13E9CF5A1E3FCECC16170FF7176D47B2919E4B4A75C2B7E00D566
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00ce9815ddbc4f47aaedda4dfe4a919f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80617paEUaY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4493784481040555
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyAb8Q5QGa0ZjNALyAZD:qgFq6g1af+Mp8QQ0nIZD
MD5:	44F5F6F4A3C7A98C82921429BBDD6F42
SHA1:	E123ADCC9323A2706A2293D1EA5FA54EA3663B93
SHA-256:	7BAAFF7D5F63793429E88D5B8609B4226B63B2001958B8A3692830D1FE32516F
SHA-512:	129F7376B55A16B44C44420BCBFD86F146B16B274F1F9C08F4F2000E92E91D1D0EC6D469EB03C1C1B676391EEE63481F146A33C6738613E179D9A8BB20F351CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8259af0452bc4e639f523cd381432c63.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80618kgDSFY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403310419701583
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MwkW8TT9YU7MqjLkGq:qgFq6g10+f+MweYU7uT
MD5:	3F75BE490AD2388F0F65AD94F29D6593
SHA1:	A0D0054B580B14CC33C2ACD35D1C5073BD628666
SHA-256:	116125F1E7F4C246704995FDC29A3BDD6A6448FE5E799854BB577F46FBEC8777
SHA-512:	80FA9FBDF2B13A3AEA2B0C64E4957449E3B8F118FB723347B09645FD2D518867D9995E2210E55AADAC6EB9C1AB7E1F46BB072A056FFA119C6F788EA82977E758
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f5b3f35ea0441169902fa17828ab22a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80619u4wIiY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.459294319335875
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzkMXFBGWMrAug2js2BI:SbFuFyLVIg1BAf+MQWLGWMUujNdQIeXD
MD5:	81AEDC4907877988661F9FBEBCF58DFF
SHA1:	9E6DFFC94639BF4EFF165DBF3D23FF1A4323D037
SHA-256:	F30F8309621AEDAA621F54184E0B0075E9DE0957D198CB73DE53B1151E0427E4
SHA-512:	632EEDEAA67C0DB2DBDA7A87D93A447187CB29217D370EF59960C11F508EC52C3ADEBD93F3BD7CDE8B74C86AAC13AC1B47698B2FF54E860F77A2E42D8E8D496A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9baf521926864adaa55910537ae80f59.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80704ON49v0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.377624743500505
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsGiSI9cHk1LH7rxsjsa:SbFuFyLVIg1BAf+MsrSI9H1nrqjNTZD
MD5:	3B176D98C84D960E0096CCAF25F9BDD4
SHA1:	5864AE17FB913A3A20A72FAA7B6FF565292B4C15
SHA-256:	A3820D47015D29BBDA63324AF416E3F66C199723608F3B66F5172367913CC174
SHA-512:	19400CE3A3E961B7495ED1A01FDA67729D9DCF7FE69756064A8F659CC1005CB2E565153466CDA283794E885B67AB11E64705FEEC7583B76BACD7A9F4657EBF55
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc7473ec56ac47399b7f7ede59adbad1.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80716UPOJlX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.466009122552007
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyATATrSt2jLTTIWTIL:qgFq6g10+f+M+TBEWEL
MD5:	FB3610F2C31E973E8F96D87209EC02DB
SHA1:	44D637F8FE0389CBAE0C67FB7E71F526BF7DC47F
SHA-256:	D4E0A24FFDD27C2F8CAF826FBEF701441F49C055EBDD6016F0960C7AFFB21900
SHA-512:	A87951D0E1CAC6FA796CB15747AE8E28E9E6DA9EF5A636953815EA84606446A051EB8F8963EC3212389FDF6887F7EB6D6449863457CE38BEFC721B3413299231
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83b2446e68c349f09e169a0b977814d5.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80812F67FKY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.410782828885477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmseDDa6eGEGoUgrxs4:SbFuFyLVIg1BG+f+Msc+6ZwTqjbVC
MD5:	EF7898BC1E7037DEA6C3C1F13193FCD5
SHA1:	C575849371C82CB5999B8D2AC74C4EAFAB65C2ED
SHA-256:	940CCC343CDC4359287C60BC49B9CEF542BF2AF7883A354FFDB0BF2A2A465E5C
SHA-512:	0986E5F0609D3E1FE15EB68D527E51A4EE0534509363AC0B14601AED2A9745A04C3F108A58B20707CE5BA154D8F28BEDF5F6AA7ACDF78F826B2478A970094DA7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f0625ff1f9fe42589cacad2bba459c1c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80857D3mR8V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.425699429261553
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5uGQVmQccHBG9ao:SbFuFyLVK6g7/+BG+f+MwccAkG70jNq
MD5:	400B2B14B4DCF0A8E7CCE10CCBE94CF4
SHA1:	B2616DDA2CD37845DF97B00601B298DD4C258387
SHA-256:	038FCD7950A804CB37517E371B9C12B48973B0A58F08E23682A631DEFEBD283A
SHA-512:	D73ACFEC422426CA82486A00BBA59A6B647DEC6CA0031458B3FAA0C7E74D6DF82ED34B7C30DDE9F9BDA006CFC712A07046C2807F34B65EB6B26D4B7CFEA49596
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3368b24c0f504e599bde20021f53da48.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:8085946d9wW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.357479075883057
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvQAUs9HSUATjs2q:SbFuFyLVI6g7/+BG+f+M4AUOHSrTjNq
MD5:	E9D0DA962700E75910A5DE83ED01C2FA
SHA1:	9B4C4D87D7F841E625994B884425BC297878E5DC
SHA-256:	5C41CF595EEBC6DC666FB0245FD0EDCED862390EC506360FDBC5814057941D7F
SHA-512:	600B906C74ECD3CBA42F6FAD5F37ED8A3A6D816B966869202EB64835335EAF6A521FD0FC355B2F9849A5C07541069633D31CED37BAEFA6857781294E472A11FF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ef324ecbfc1f405ba1b7defb04bb10a4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80896orMcBY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.497341170964745
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4jyZjFQMzKaBu:qgFqo6g7/+0+f+M4jyvTmh
MD5:	89E80ADEB1BBF404CACD7DC70B53E9E2
SHA1:	E713F4ACF267B24C038B1F5B2C5B2E24D28D2004
SHA-256:	3876788090FE9D99CCF845AE9484EEE8AACA960BB30CB8EEA33557BA2BA91FDE
SHA-512:	96C70C416E61A90244E35D2A333756BDCE7D3866A97A688FE8F4222BD0C5821239ACB1EE0FA1351FD9501AFAE44EC607375A53523D853BA435C98BE948FDB12D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c2b3529653c47ed8bb366cd03db46bc.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81839wNJ1BW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.350352408568888
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7Pnz3EHdvQCA022jx:SbFuFyLVIg1BG+f+Mj7EH5AN2joa
MD5:	E08E353244EB6451B9B7A654C0F84D5E
SHA1:	49AF6441DD521B3731340D985DD822670F3B6487
SHA-256:	EEC3BBB0CEE789A9AE628F352C7BEE1E7C8BC0254E57563AFE5F56711387F5A1
SHA-512:	DF432229C29E6F67F7F6DAD49BC64367FB4A897D5EE872ADB5C3E8F1BBEDC4552B8856415204A2105A4DE414A2E2B980B25994D7ECFD9FABB6002A69F60ED1C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f64de37aabd4f848795af4fad1655fe.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:81844JFGqUW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.333526447819934
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvydBEGWeV17DDZATh:SbFuFyLVIg1BG+f+MqDvBNATjtWL0
MD5:	29760E2E19901704A86C134D0AF3CE10
SHA1:	6C9A18582DBBC2CC49573387F102725F411AC928
SHA-256:	1C1A1B4E1F1053304429E35A50F0FB2935DBEF9BE79178E62319BBC16AB9BCAC
SHA-512:	657EF0B13A98353C8B599907509F9C7D0EE721A0A11243C06D8013531F61828893C291DB2ADB50AB81CE9A6F8A560C399C1484D9D3794ED400BAF72AF87147DD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9f3c0149dcb4c818dc560a0a95a8ffd.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:81857EHqc0W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.415658015763294
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mo0kBrGc2c9WIm0jNE:qgFq6g10+f+MojrGc2c97mCE
MD5:	3B9ACC2554C722D3962640B149239E2F
SHA1:	AC3065343360749F7A32B59E04E2A81633FB6044
SHA-256:	911F63AA8FCEC910E3B4757021472A559B1BC7E3DE316114F61A3CDD8E45A1ED
SHA-512:	514ABF7AC27D07B12F60B182411EBA55C47E54ED8E00BC421222D71B7AC488836F90885F9C3E8A974F95264126CCD2D28AF9BAAB54426CA8225D752FB8974482
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b474470fdd8c499b939eb77e8544f770.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:81922jFbhRZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.506864980488555
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M5XvVTvF2jFQMzKaBu:qgFqdg7/+0+f+M5fxFETmh
MD5:	1222EF903E52E06F5889EA9A8A236C53
SHA1:	88E84537986F535A05A206C50AEDDE1713D4C287
SHA-256:	332CEB53EDBEFA2DBD3D6EA47A772258AD56E545C2EA1F14D046644C522924A9
SHA-512:	C5270B4B5FDC678E7DC83A700F99BF656FC347BADDC89648F4DBC5438E23F4D13194348B76EA5680C9FDBC9634EB64FC6A81625279D5BE0727366B8C2BB6E3E4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=990505ebf43d4542b07326970001a826.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat08rrKkb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0EL8Hhj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0MNwDvh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0T1MpyB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0ULXDkB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0hvD3Ii

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0nHYR1G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0y8Ixoj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1274ZU6fA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491968736980953
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8NgxYhet6bv:qgFq30dABibBENgZIbv
MD5:	0148258EFFDECA23A4864F7486BF1614
SHA1:	CB92F963EC53F7D07F5657DD2A0264B762B4C821
SHA-256:	1A6299FAD422673E08F4FD8B192BB3A3268FF3BA048425CDEFB6BF1DCE5B7795
SHA-512:	2413BE50716BBEB564C6700F63ED19C56F97B3EC15ABE9F3A209298A40550047C87E5495DB10FE87B0973FE2523E4681DF541AD73B861DED8B62CD6D6BAAD99B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14923.REALTIME=1735414181849670.MONOTONIC=584720396.LAST_SESSION_TIMESTAMP=584815235.

/run/systemd/users/.#12775S85e

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.29212674166057
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAenFOW2cJ3206qodqiVPn:SbFuFyL3BVgdL87iesnAiRJg7n2w3t67
MD5:	337BBCA65F0692996B729E81342704B8
SHA1:	DB654D1AE539A0720C6427496E42787CA00E8F9C
SHA-256:	70CCA27F33702581AF3557D86E971497C9DD12068059822083B5F60CF79C433D
SHA-512:	11C5FECB009D92E590E67DD88414968CCB899F4CF742B8DAC2A7A2758EAD530D14B24B892EB69042D9EE3B3C1D3431EE8FF798679A6553C3080DF85989B518C3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735414116659710.MONOTONIC=519530436.LAST_SESSION_TIMESTAMP=519609599.

/run/systemd/users/.#1278LmcXj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.326982670202355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA23vo/x4Ap/x6H206qodiwTJ:SbFuFyL3BVgdL87iesnAiRJgK7Dit6p
MD5:	67D7F03CE041AC88A09079289B0A93B2
SHA1:	48E2A11741AF2B747D4CD0B634A8C4F4DAE68D98
SHA-256:	E692E2161C128B08FD12F224DA39CBBE6EE9FA853645D50C41888ACFA55AB192
SHA-512:	F8613731572914A15C0891EE0634584F26E46564BD71DA4F3BD53551E5DB4559B7C1BBD15167D825659F6FCCCD18F1731E65E01B8D4A8AEDE2E2481BE834DBF2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735414079475394.MONOTONIC=482346120.LAST_SESSION_TIMESTAMP=482433186.

/run/systemd/users/.#1279piJDB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.339199319737256
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAGFVwqr5/uVWT206qodjZv:SbFuFyL3BVgdL87iesnAiRJgxYhet6bv
MD5:	32838678119A60C9C31C4F253C15AAFC
SHA1:	49F2C8EB3D4304F0E76DCB5302DD008BDB2EDA01
SHA-256:	D685EE87E7ED8B85EBB39FF1B37AB776581249C343AC539BE01D321857C9448E
SHA-512:	034D40005E0135B1C063F77FD4763B7C8B741D5879F8124B91D2294D609256461A6612F4517CA9D49960D4D4D2DFA72E637E283F430653A6975A8A08EFF86940
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735414181849670.MONOTONIC=584720396.LAST_SESSION_TIMESTAMP=584815235.

/run/systemd/users/.#127CXfyBE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.306369084257643
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8ygxYhl2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygxthQHtPYq9M
MD5:	A617CAA479D5AB517FE05FA3F490A312
SHA1:	929DF3B7E4CB1885C89D845F67E14518BF6F3F1C
SHA-256:	1A7EA1D80DF454F937010D2855778A5726A6A4F1FDA9BCA3047EB4E90814D321
SHA-512:	A822E43AE843463EE700581747287166688EDBF4C00462023D72B40C4C8254F5B19D831C2A81221078DD81DAAF2AFE26E5317C18F38A75CB672E68961D226CFA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14861.REALTIME=1735414181849670.MONOTONIC=584720396.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127FU8R0f

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127JjPG7j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300421155167692
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgK72gRsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgzjthQHtPYq9M
MD5:	2D7C6B601D340E0876B752E92F55CE94
SHA1:	AFCE1B53B327A3591A098D347199A14EAF5D8E28
SHA-256:	EDDD02AFC6CE27422E84B48B972A8E4273934B15EB8EBC5FA632F94FE2E9F0DA
SHA-512:	8D16FF5B9265B770BF25634E0411FABC15B68FE50498D47A8A4AF31B12170E221CF5CDB998EA12E1BE02723ECBB8D03704C92B02B79D57093B5DA254E78261CD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1735414079475394.MONOTONIC=482346120.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Kiq5kf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.448688537633852
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff1Jg7n2w3t6sY:qgFq30dABibBdJglI7
MD5:	3C37407287015014DDE112C0A2DCA76E
SHA1:	497C4388B10E0AA6DBD670BDE5E351FD622D6976
SHA-256:	4FADCB16AD99752CDEB82DD5351BC8E322EFF9BE61E37D7D6415AA43ECFE6114
SHA-512:	2A82F4BAB042659002A5A95D0E910AD27F95496F7D341FF952C7DBE7B134EC6E80BD26AB990069DA907153C59C82DCAF0FA3C3C1DAE09F597C1F6E7A2F93AB30
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13947.REALTIME=1735414116659710.MONOTONIC=519530436.LAST_SESSION_TIMESTAMP=519609599.

/run/systemd/users/.#127LcJS7h

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UXhjgg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.298056169858836
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffeJg7n2w82thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB2JgNthQHtPYq9M
MD5:	1902BD5BF6262CE10C956BEAC8201007
SHA1:	4BCF9ACD56799C9C9BDD46D1B1AF306F529E21D8
SHA-256:	D3E64879AFB39E1B28E2F50163EE63970AB62C416CFB1E314C5EF5E30D85ED0E
SHA-512:	DEB1282108C94CA1DABA4EB6069046015B9E98BD8CC854172E1875202E6113374E54530210A950D9782D4E3E7632B95F19EA60CC7AD1C8B7C9BA3307D5B75D34
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13885.REALTIME=1735414116659710.MONOTONIC=519530436.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lYYOGf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.298056169858836
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffeJg7n2w82thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB2JgNthQHtPYq9M
MD5:	1902BD5BF6262CE10C956BEAC8201007
SHA1:	4BCF9ACD56799C9C9BDD46D1B1AF306F529E21D8
SHA-256:	D3E64879AFB39E1B28E2F50163EE63970AB62C416CFB1E314C5EF5E30D85ED0E
SHA-512:	DEB1282108C94CA1DABA4EB6069046015B9E98BD8CC854172E1875202E6113374E54530210A950D9782D4E3E7632B95F19EA60CC7AD1C8B7C9BA3307D5B75D34
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13885.REALTIME=1735414116659710.MONOTONIC=519530436.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pMZTYC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491968736980953
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8NgxYhet6bv:qgFq30dABibBENgZIbv
MD5:	0148258EFFDECA23A4864F7486BF1614
SHA1:	CB92F963EC53F7D07F5657DD2A0264B762B4C821
SHA-256:	1A6299FAD422673E08F4FD8B192BB3A3268FF3BA048425CDEFB6BF1DCE5B7795
SHA-512:	2413BE50716BBEB564C6700F63ED19C56F97B3EC15ABE9F3A209298A40550047C87E5495DB10FE87B0973FE2523E4681DF541AD73B861DED8B62CD6D6BAAD99B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14923.REALTIME=1735414181849670.MONOTONIC=584720396.LAST_SESSION_TIMESTAMP=584815235.

/run/systemd/users/.#127qfdBYf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.448688537633852
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff1Jg7n2w3t6sY:qgFq30dABibBdJglI7
MD5:	3C37407287015014DDE112C0A2DCA76E
SHA1:	497C4388B10E0AA6DBD670BDE5E351FD622D6976
SHA-256:	4FADCB16AD99752CDEB82DD5351BC8E322EFF9BE61E37D7D6415AA43ECFE6114
SHA-512:	2A82F4BAB042659002A5A95D0E910AD27F95496F7D341FF952C7DBE7B134EC6E80BD26AB990069DA907153C59C82DCAF0FA3C3C1DAE09F597C1F6E7A2F93AB30
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13947.REALTIME=1735414116659710.MONOTONIC=519530436.LAST_SESSION_TIMESTAMP=519609599.

/run/systemd/users/.#127uXWjOi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300421155167692
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgK72gRsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgzjthQHtPYq9M
MD5:	2D7C6B601D340E0876B752E92F55CE94
SHA1:	AFCE1B53B327A3591A098D347199A14EAF5D8E28
SHA-256:	EDDD02AFC6CE27422E84B48B972A8E4273934B15EB8EBC5FA632F94FE2E9F0DA
SHA-512:	8D16FF5B9265B770BF25634E0411FABC15B68FE50498D47A8A4AF31B12170E221CF5CDB998EA12E1BE02723ECBB8D03704C92B02B79D57093B5DA254E78261CD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1735414079475394.MONOTONIC=482346120.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vyiBED

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127x9JgTA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.306369084257643
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8ygxYhl2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygxthQHtPYq9M
MD5:	A617CAA479D5AB517FE05FA3F490A312
SHA1:	929DF3B7E4CB1885C89D845F67E14518BF6F3F1C
SHA-256:	1A7EA1D80DF454F937010D2855778A5726A6A4F1FDA9BCA3047EB4E90814D321
SHA-512:	A822E43AE843463EE700581747287166688EDBF4C00462023D72B40C4C8254F5B19D831C2A81221078DD81DAAF2AFE26E5317C18F38A75CB672E68961D226CFA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14861.REALTIME=1735414181849670.MONOTONIC=584720396.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mWQv:mWQv
MD5:	7DC4A7CC86CAFCF312B0D56C42F83151
SHA1:	AADAB93FD7239399FB31AEA1B20802333FA1B999
SHA-256:	205630253BA3FD1883F61B98002EFE5C7B5A113795774071CA89FF44CA4EBC63
SHA-512:	62B52822C6294D7C1AFED15270CBE852450FBFBA6D8E043DF6FAF0BE62AE3F7E8EAEE2B578E2BDC41818E0D233A211042C3892FC810140633B4E2F266B28796B
Malicious:	false
Preview:	7035.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nVn:V
MD5:	F4A176795176F96BAEB9D95941B61769
SHA1:	F9C2C15DCC87D632476B168302E14A3394F21F97
SHA-256:	3573D61E6CA4FBA8D4C3486BC715745F844F3C1E2BAEFD4F64E4FDDB17016345
SHA-512:	DAF4DE51CB2184916B00E9C72FD3BB43B0CF4418B77A93E189E793770A300A085348ED52E7B3B1F3459EB690D9C9BE8A76CAAF2C83F718E5127A68562476866C
Malicious:	false
Preview:	7119.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:SG1sXlXEWtl/T:Sh+ylL
MD5:	60EB0E07BE6E989AE0CB225D4AB40705
SHA1:	430CFF73364B0037B67AE5B6AAD5F372CDDB734C
SHA-256:	D333008BFD791D86D45952815D47026F0797F1F454EC187D128D4EF0715CF7AA
SHA-512:	57612070B825DEF7C513AD5D132E0C15484F7720CBDC5BB73EB1A4628B659D362FF33B718C48AD7B61A2903D8FFB9F824B13F7F50C450449F7C5277A759F91FC
Malicious:	false
Preview:	....<...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................<....Qpg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nBvn:Bvn
MD5:	D4E7D4B7D56269579B8FF4367B5CB9B9
SHA1:	B9269170E8FEEDC29E08E918A7A808140D94B1FB
SHA-256:	EBD787BC2D07FB1B4026CF1F3F166F50F02DC1175D09E09A92E09206F7368A44
SHA-512:	AEA99B2BB78E10283E3D352B909F93171D3BC684E205862F7D9B28D545F4B5AB4EE858DA7853A5014475171850499B1B3769A5F6C64E52E22DBD29A0CED5E38C
Malicious:	false
Preview:	7124.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nGn:Gn
MD5:	2BAB2C945DCD675FB65F54B083394261
SHA1:	E321F076ECB6FD7ABCE2256B1FB63F72FF123FB0
SHA-256:	B272C83BA92507F71388498FB8E0110C9BCE0876D86BF2C954E5ED0E907C7E6A
SHA-512:	F45D522C40CF6900EAD288F19BC3B04A5FBB5A1215FA7E12E61DE837CC98705BD065183489225F1AF593606C8A02BC51F70BD4A34A5ED1D7ECE5EC3D465619B8
Malicious:	false
Preview:	7118.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:n8Tn:8n
MD5:	3556139B29BD47BD5F62AE891B81D001
SHA1:	77446F4D16F51E4AC89EE719E38D6F938B344822
SHA-256:	1D1670FF41E0CC89548ED293EDB7BE522BD0D4BEC968CB4470607E0FF4460EB4
SHA-512:	C3DD7ED8459EBD3C6B840BA492BEC824E58DFB09A2E47C6CE90341FF644B869ECA7463F90CF90CA1C3329F19654D7256551478DAEA030164CA9D5C64B58BD2FF
Malicious:	false
Preview:	7103.7104.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nVn:V
MD5:	F4A176795176F96BAEB9D95941B61769
SHA1:	F9C2C15DCC87D632476B168302E14A3394F21F97
SHA-256:	3573D61E6CA4FBA8D4C3486BC715745F844F3C1E2BAEFD4F64E4FDDB17016345
SHA-512:	DAF4DE51CB2184916B00E9C72FD3BB43B0CF4418B77A93E189E793770A300A085348ED52E7B3B1F3459EB690D9C9BE8A76CAAF2C83F718E5127A68562476866C
Malicious:	false
Preview:	7119.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nBvn:Bvn
MD5:	D4E7D4B7D56269579B8FF4367B5CB9B9
SHA1:	B9269170E8FEEDC29E08E918A7A808140D94B1FB
SHA-256:	EBD787BC2D07FB1B4026CF1F3F166F50F02DC1175D09E09A92E09206F7368A44
SHA-512:	AEA99B2BB78E10283E3D352B909F93171D3BC684E205862F7D9B28D545F4B5AB4EE858DA7853A5014475171850499B1B3769A5F6C64E52E22DBD29A0CED5E38C
Malicious:	false
Preview:	7124.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nGn:Gn
MD5:	2BAB2C945DCD675FB65F54B083394261
SHA1:	E321F076ECB6FD7ABCE2256B1FB63F72FF123FB0
SHA-256:	B272C83BA92507F71388498FB8E0110C9BCE0876D86BF2C954E5ED0E907C7E6A
SHA-512:	F45D522C40CF6900EAD288F19BC3B04A5FBB5A1215FA7E12E61DE837CC98705BD065183489225F1AF593606C8A02BC51F70BD4A34A5ED1D7ECE5EC3D465619B8
Malicious:	false
Preview:	7118.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:n8Tn:8n
MD5:	3556139B29BD47BD5F62AE891B81D001
SHA1:	77446F4D16F51E4AC89EE719E38D6F938B344822
SHA-256:	1D1670FF41E0CC89548ED293EDB7BE522BD0D4BEC968CB4470607E0FF4460EB4
SHA-512:	C3DD7ED8459EBD3C6B840BA492BEC824E58DFB09A2E47C6CE90341FF644B869ECA7463F90CF90CA1C3329F19654D7256551478DAEA030164CA9D5C64B58BD2FF
Malicious:	false
Preview:	7103.7104.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nVn:V
MD5:	F4A176795176F96BAEB9D95941B61769
SHA1:	F9C2C15DCC87D632476B168302E14A3394F21F97
SHA-256:	3573D61E6CA4FBA8D4C3486BC715745F844F3C1E2BAEFD4F64E4FDDB17016345
SHA-512:	DAF4DE51CB2184916B00E9C72FD3BB43B0CF4418B77A93E189E793770A300A085348ED52E7B3B1F3459EB690D9C9BE8A76CAAF2C83F718E5127A68562476866C
Malicious:	false
Preview:	7119.

/var/lib/AccountsService/users/gdm.8F3OZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.TFIVZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.Z2RKZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.949921351119227
Encrypted:	false
SSDEEP:	24:ARZea8vG8DM0FkAvkkA2+ViTHBa60pYrg7JrGz4rCQU:AupIkJvkJfViTH8FYrgNrI4rCn
MD5:	E951AC3E2F6AF11F4ADC55507808B3C2
SHA1:	210FDEEBF5E94B60BF1238E4CD68719E4D1C6123
SHA-256:	B239AB170753F47F5D54549657C8226C71FB3065DE867AF8C41AFD090DA8E25A
SHA-512:	3270E940B041883644ACFC2550CDCB95042D3775E1958CF4AA25E145F10CF963800FE5264791A3A1692F8899F93A6DB7C384C69D214F5A1049740EE544A37B97
Malicious:	false
Preview:	Dec 28 13:29:27 galassia systemd-logind[6975]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 13:29:27 galassia systemd-logind[6975]: User enumeration failed: Invalid argument.Dec 28 13:29:27 galassia systemd-logind[6975]: User of session 2 not known..Dec 28 13:29:27 galassia systemd-logind[6975]: Session enumeration failed: No such file or directory.Dec 28 13:29:27 galassia systemd-logind[6975]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 13:29:27 galassia systemd-logind[6975]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 13:29:27 galassia systemd-logind[6975]: New seat seat0..Dec 28 13:29:41 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 13:29:41 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 13:29:41 galassia systemd-logind[6975]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlARDfhlQRDfxl:F3wRDfzQRDfj
MD5:	9C6DD542A3394D08FCDF9C4DB5C1BA3E
SHA1:	58BA87BF4160416641F40C44F546A02466A967E5
SHA-256:	AEFF68219E58D63CFF60BFD29A0B7104A9CEFB8C6F457649651DD321452B07C0
SHA-512:	AFEAFC226396671060088C36C1068EABD42FF5A501514B084ADC52E7533CFACDB85188D9CFB7A9D1A5F94850980AA04A98CA086F469C928BBECE75B64EEA4271
Malicious:	false
Preview:	LPKSHHRH.................JKy.<@e..Dz)....................................JKy.<@e..Dz)...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlKANqQANa:F3a4
MD5:	0C68D2A943FED572C155979A9C85C948
SHA1:	F13BCFC45132A316E1366F079B88345B5A1E25D0
SHA-256:	6E96E21A11E5BA1E4B6B17FD60FF943779A46BFDB90EE2377B4DF3606927586E
SHA-512:	2E934609D8C4FEA8A834B315CCE26D7C3B9776D22C44735B09C6EDE8F9255C606217BD789BA2DF529AE320D441F22690BF1DE71B26D5175A92D1F879CB832CEB
Malicious:	false
Preview:	LPKSHHRH................l....`Ht.g...z.h................................l....`Ht.g...z.h........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12311
Entropy (8bit):	4.9760943803521975
Encrypted:	false
SSDEEP:	96:vqTZw4QVEb25d7JzJgy5CR5CwxzFYHDDvIpqMm8GaGQRH3DE/okXOLATjBsx8DXg:7/Ui8pFvr8V3UPo1XasMdro+hdmQ
MD5:	B7BE7C20555E83CAD6ABF9FB79046E44
SHA1:	29FBD5EAF03E959D8FE3D1FF85D168BD37E3C062
SHA-256:	02CF04674A6ECC4211E1A6CF822F986DA0C47C854FB264F85EC8B982B09A64E4
SHA-512:	77F1D6317E0B5A794F23DA9584EA7DEEBB24060CC1B1EE3F7F50670245C38F09694BA32882FA99092D82EC36529B642031446474B05CF20FCC54FA72C750DB2A
Malicious:	false
Preview:	Dec 28 13:29:17 galassia kernel: [ 558.486101] New task spawned: old: (tgid 6965, tid 6965), new (tgid: 6965, tid: 6969).Dec 28 13:29:17 galassia kernel: [ 558.803069] blocking signal 9: 6241 -> 658.Dec 28 13:29:17 galassia kernel: [ 558.807617] blocking signal 9: 6241 -> 720.Dec 28 13:29:17 galassia kernel: [ 558.812499] blocking signal 9: 6241 -> 772.Dec 28 13:29:17 galassia kernel: [ 558.821969] blocking signal 9: 6241 -> 936.Dec 28 13:29:17 galassia kernel: [ 558.827261] blocking signal 9: 6241 -> 2048.Dec 28 13:29:17 galassia kernel: [ 559.880914] New task spawned: old: (tgid 7036, tid 7036), new (tgid: 7036, tid: 7041).Dec 28 13:29:17 galassia kernel: [ 559.881109] New task spawned: old: (tgid 7036, tid 7036), new (tgid: 7036, tid: 7042).Dec 28 13:29:17 galassia kernel: [ 559.895394] New task spawned: old: (tgid 7036, tid 7041), new (tgid: 7036, tid: 7043).Dec 28 13:29:17 galassia kernel: [ 560.136969] New task spawned: old: (tgid 7040, tid 7040), new (tgid: 7044, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	31997
Entropy (8bit):	5.126397048725356
Encrypted:	false
SSDEEP:	768:JsE1R1nDR1nDR1niEAsxFLSoQ8CBXblKxDxfxZxtzE9DxXaCe8g5WqU8xNTw3zdr:CgAsxQyZlfXzE9FXwW
MD5:	FE368CD55B2DE02061A9C1C47B2748FC
SHA1:	74F9BE1B7D16966FA55E4F2A39B1A5622CCC3072
SHA-256:	2F66A47F7BCD858C1C74BEC74305D10628E0473BB9056576DE669ADDF215BD9B
SHA-512:	52120B025274AB15ABB9AF3262F77ACA1D8205C3F3B00AF9E901A3F9A9C087B46C3947B8F5E6F170F6F3ADB4775A67AA1650EFB18E180C313136FF0A495B023F
Malicious:	false
Preview:	Dec 28 13:29:15 galassia rtkit-daemon[6966]: Exiting cleanly..Dec 28 13:29:17 galassia kernel: [ 558.486101] New task spawned: old: (tgid 6965, tid 6965), new (tgid: 6965, tid: 6969).Dec 28 13:29:17 galassia kernel: [ 558.546456] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 28 13:29:17 galassia kernel: [ 558.546469] systemd[1]: Stopped Journal Service..Dec 28 13:29:17 galassia kernel: [ 558.547506] systemd[1]: Starting Journal Service....Dec 28 13:29:17 galassia kernel: [ 558.592018] systemd[1]: getty@tty2.service: Succeeded..Dec 28 13:29:17 galassia kernel: [ 558.592582] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 6..Dec 28 13:29:17 galassia kernel: [ 558.592589] systemd[1]: Stopped Getty on tty2..Dec 28 13:29:17 galassia kernel: [ 558.593176] systemd[1]: Started Getty on tty2..Dec 28 13:29:17 galassia kernel: [ 558.593393] systemd[1]: systemd-logind.service: Main process exited, code=killed, status

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:SG1sXlXEWtl/T:Sh+ylL
MD5:	60EB0E07BE6E989AE0CB225D4AB40705
SHA1:	430CFF73364B0037B67AE5B6AAD5F372CDDB734C
SHA-256:	D333008BFD791D86D45952815D47026F0797F1F454EC187D128D4EF0715CF7AA
SHA-512:	57612070B825DEF7C513AD5D132E0C15484F7720CBDC5BB73EB1A4628B659D362FF33B718C48AD7B61A2903D8FFB9F824B13F7F50C450449F7C5277A759F91FC
Malicious:	true
Preview:	....<...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................<....Qpg........................................

Source: wkb86.elf	Virustotal: Detection: 53%			Perma Link
Source: wkb86.elf	ReversingLabs: Detection: 48%

Source: global traffic	TCP traffic: 192.168.2.23:50020 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:53464 -> 178.215.238.153:33966

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.941891428729997
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wkb86.elf
File size:	116'588 bytes
MD5:	7a27473790125d4b47574c56c08034cb
SHA1:	0770d21c7616d8e7e78584246ded03559eba1ce1
SHA256:	d4b845fcb1189d00e1d2d3adb8bcd9ac93cbc3d071239b113a9a58dd73d3f88a
SHA512:	4aa08559b1851c00327784225a2e3a4e7b55745407b9c61c4390f46691955ee0082502ae709646341a7fb901e1298e1d8156d08ac0f81ba1cbbfb5f2302f8805
SSDEEP:	3072:qQqD7K0a4sqPEd6W+4GITR+c7NIAhL2DsPcQsiM:3qXKz45q6W+BAl+kcQPM
TLSH:	42B37CC4F243E4F5E86301706037FB379B32E4795129EE43D7A5AD36ACA2641DA0BA5C
File Content Preview:	.ELF....................d...4...........4. ...(......................~...~...............~...........G..............Q.td............................U..S............h.....P..[]...$.............U......=.U...t..5....D......D.......u........t....h............

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	116188
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x15116	0x0	0x6	AX	16
.fini	PROGBITS	0x805d1c6	0x151c6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805d1e0	0x151e0	0x2c33	0x0	0x2	A	32
.ctors	PROGBITS	0x8060e18	0x17e18	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8060e24	0x17e24	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8060e40	0x17e40	0x475c	0x0	0x3	WA	32
.bss	NOBITS	0x80655a0	0x1c59c	0x492c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1c59c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x17e13	0x17e13	6.5917	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x17e18	0x8060e18	0x8060e18	0x4784	0x90b4	0.3806	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 20:26:52.034501076 CET	35348	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:52.506896019 CET	53	35348	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:52.506983042 CET	52243	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:52.629492998 CET	53	52243	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:52.629584074 CET	40654	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:52.751929045 CET	53	40654	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:52.753737926 CET	50345	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:52.876022100 CET	53	50345	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:52.880281925 CET	52956	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:53.002734900 CET	53	52956	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:53.002836943 CET	49675	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:53.125345945 CET	53	49675	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:54.558041096 CET	58627	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:54.680788994 CET	53	58627	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:54.680880070 CET	53817	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:54.803821087 CET	53	53817	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:54.803904057 CET	41039	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:54.926671982 CET	53	41039	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:54.926742077 CET	49956	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.049093008 CET	53	49956	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.049155951 CET	35279	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.171694994 CET	53	35279	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.171794891 CET	43915	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.294711113 CET	53	43915	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.294795990 CET	47137	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.417582989 CET	53	47137	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.417680979 CET	33979	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.540637016 CET	53	33979	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.540719986 CET	60569	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.663232088 CET	53	60569	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:55.663471937 CET	51442	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:55.785907030 CET	53	51442	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.219912052 CET	33600	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.343488932 CET	53	33600	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.343698978 CET	53627	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.467016935 CET	53	53627	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.467327118 CET	33281	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.589726925 CET	53	33281	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.590055943 CET	56668	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.713885069 CET	53	56668	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.714116096 CET	44190	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.838172913 CET	53	44190	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.838478088 CET	52527	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:57.962008953 CET	53	52527	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:57.962302923 CET	42380	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:58.085859060 CET	53	42380	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:58.086137056 CET	47180	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:58.209799051 CET	53	47180	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:58.209886074 CET	49727	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:58.332437992 CET	53	49727	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:58.332528114 CET	42348	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:26:58.455353975 CET	53	42348	8.8.8.8	192.168.2.23
Dec 28, 2024 20:26:59.896528959 CET	50804	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.020808935 CET	53	50804	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.020919085 CET	50743	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.143424034 CET	53	50743	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.143557072 CET	49486	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.265820026 CET	53	49486	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.266032934 CET	52692	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.389491081 CET	53	52692	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.389735937 CET	40956	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.513371944 CET	53	40956	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.513601065 CET	33653	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.636399031 CET	53	33653	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.636513948 CET	52790	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.762501001 CET	53	52790	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.762588978 CET	45537	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:00.890580893 CET	53	45537	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:00.890898943 CET	59376	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:01.013650894 CET	53	59376	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:01.013856888 CET	51276	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:01.136444092 CET	53	51276	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:02.618494034 CET	49380	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:02.741277933 CET	53	49380	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:02.741364002 CET	42807	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:02.864234924 CET	53	42807	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:02.864312887 CET	53262	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:02.987277985 CET	53	53262	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:02.987360954 CET	39860	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.116780996 CET	53	39860	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.116863966 CET	60214	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.242664099 CET	53	60214	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.242758036 CET	47990	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.365080118 CET	53	47990	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.365264893 CET	50850	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.487518072 CET	53	50850	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.487713099 CET	50998	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.610259056 CET	53	50998	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.610349894 CET	35518	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.733069897 CET	53	35518	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:03.733150005 CET	44193	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:03.856873989 CET	53	44193	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.288255930 CET	54482	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:05.410665989 CET	53	54482	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.411062956 CET	35000	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:05.533505917 CET	53	35000	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.533638000 CET	40261	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:05.655924082 CET	53	40261	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.656143904 CET	43286	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:05.778459072 CET	53	43286	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.778650999 CET	44021	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:05.901918888 CET	53	44021	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:05.902148962 CET	40787	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:06.024641991 CET	53	40787	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:06.024746895 CET	56958	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:06.147213936 CET	53	56958	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:06.147404909 CET	56401	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:06.269649029 CET	53	56401	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:06.269834042 CET	50434	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:06.392276049 CET	53	50434	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:06.392498016 CET	45715	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:06.514866114 CET	53	45715	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:07.899715900 CET	40454	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.024482965 CET	53	40454	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.024554014 CET	57569	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.146879911 CET	53	57569	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.146945953 CET	46604	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.269707918 CET	53	46604	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.269798994 CET	57367	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.395984888 CET	53	57367	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.396081924 CET	56716	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.518732071 CET	53	56716	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.518845081 CET	44549	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.641360044 CET	53	44549	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.641472101 CET	55396	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.763900042 CET	53	55396	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.764008045 CET	53647	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:08.888196945 CET	53	53647	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:08.888314009 CET	58630	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:09.017283916 CET	53	58630	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:09.017396927 CET	58148	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:09.145287991 CET	53	58148	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:10.595597982 CET	44762	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:10.725730896 CET	53	44762	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:10.726016998 CET	38114	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:10.848676920 CET	53	38114	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:10.849024057 CET	59113	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:10.971466064 CET	53	59113	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:10.971715927 CET	59321	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.094450951 CET	53	59321	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.094599962 CET	56787	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.217228889 CET	53	56787	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.217567921 CET	51991	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.343307972 CET	53	51991	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.343496084 CET	56760	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.466305971 CET	53	56760	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.466628075 CET	57867	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.590804100 CET	53	57867	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.590977907 CET	32897	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.717914104 CET	53	32897	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:11.718152046 CET	39949	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:11.847460032 CET	53	39949	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.337940931 CET	51570	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:16.460309982 CET	53	51570	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.460736990 CET	34278	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:16.583365917 CET	53	34278	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.583719969 CET	33282	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:16.707791090 CET	53	33282	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.708250999 CET	46305	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:16.831751108 CET	53	46305	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.832250118 CET	40064	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:16.954701900 CET	53	40064	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:16.955219030 CET	40941	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:17.077811956 CET	53	40941	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:17.078061104 CET	36537	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:17.200553894 CET	53	36537	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:17.200803041 CET	60806	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:17.323477030 CET	53	60806	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:17.323757887 CET	42095	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:17.446290016 CET	53	42095	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:17.446410894 CET	59655	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:17.568957090 CET	53	59655	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.047684908 CET	45856	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.170434952 CET	53	45856	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.170600891 CET	49635	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.293066978 CET	53	49635	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.293180943 CET	58070	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.415719032 CET	53	58070	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.415884972 CET	45442	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.538157940 CET	53	45442	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.538328886 CET	33383	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.660906076 CET	53	33383	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.661026001 CET	34927	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.783951998 CET	53	34927	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.784071922 CET	33372	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:19.906744957 CET	53	33372	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:19.906953096 CET	54695	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:20.029521942 CET	53	54695	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:20.029732943 CET	34947	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:20.152373075 CET	53	34947	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:20.152513981 CET	46768	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:20.274857998 CET	53	46768	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:21.660698891 CET	40548	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:21.783202887 CET	53	40548	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:21.783365965 CET	53858	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:21.906207085 CET	53	53858	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:21.906361103 CET	54351	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.029006004 CET	53	54351	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.029130936 CET	56779	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.151478052 CET	53	56779	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.151621103 CET	34453	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.274705887 CET	53	34453	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.274825096 CET	37115	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.397317886 CET	53	37115	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.397449970 CET	46732	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.521182060 CET	53	46732	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.521269083 CET	41204	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.643687963 CET	53	41204	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.643862963 CET	46946	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.766374111 CET	53	46946	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:22.766664982 CET	52068	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:27:22.889122963 CET	53	52068	8.8.8.8	192.168.2.23
Dec 28, 2024 20:27:41.363961935 CET	43843	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:27:41.364000082 CET	34342	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:27:41.502099991 CET	53	34342	1.1.1.1	192.168.2.23
Dec 28, 2024 20:27:41.597618103 CET	53	43843	1.1.1.1	192.168.2.23
Dec 28, 2024 20:27:42.076947927 CET	48704	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:27:42.214204073 CET	53	48704	1.1.1.1	192.168.2.23
Dec 28, 2024 20:28:04.707184076 CET	60625	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:28:04.847218990 CET	53	60625	1.1.1.1	192.168.2.23
Dec 28, 2024 20:28:19.862831116 CET	38898	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:28:20.001048088 CET	53	38898	1.1.1.1	192.168.2.23
Dec 28, 2024 20:29:07.904483080 CET	60987	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.027055979 CET	53	60987	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.027136087 CET	47014	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.151721954 CET	53	47014	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.151808023 CET	37177	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.274091959 CET	53	37177	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.274244070 CET	53446	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.396473885 CET	53	53446	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.396576881 CET	51396	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.518832922 CET	53	51396	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.518959045 CET	33703	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.641139030 CET	53	33703	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.641263008 CET	40159	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.763634920 CET	53	40159	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.763751984 CET	55383	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:08.887087107 CET	53	55383	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:08.887192965 CET	36093	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:09.012325048 CET	53	36093	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:09.012424946 CET	50856	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:09.134752035 CET	53	50856	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:10.636970043 CET	56070	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:10.759430885 CET	53	56070	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:10.759643078 CET	56653	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:10.881983042 CET	53	56653	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:10.882297993 CET	49103	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.004908085 CET	53	49103	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.005134106 CET	53480	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.127528906 CET	53	53480	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.127736092 CET	52635	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.249952078 CET	53	52635	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.250278950 CET	54659	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.372509956 CET	53	54659	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.372689009 CET	38882	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.495012045 CET	53	38882	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.495359898 CET	46059	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.617542982 CET	53	46059	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.617827892 CET	37852	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.740317106 CET	53	37852	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:11.740654945 CET	60684	53	192.168.2.23	8.8.8.8
Dec 28, 2024 20:29:11.869404078 CET	53	60684	8.8.8.8	192.168.2.23
Dec 28, 2024 20:29:21.121923923 CET	53592	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:29:21.121999025 CET	48207	53	192.168.2.23	1.1.1.1
Dec 28, 2024 20:29:21.261239052 CET	53	48207	1.1.1.1	192.168.2.23
Dec 28, 2024 20:29:21.349499941 CET	53	53592	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 20:27:42.548399925 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 20:29:02.578206062 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-28 19:27:47 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 19:27:47 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 19:27:47 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 19:27:48 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 19:27:48 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	19:26:51
Start date (UTC):	28/12/2024
Path:	/tmp/wkb86.elf
Arguments:	/tmp/wkb86.elf
File size:	116588 bytes
MD5 hash:	7a27473790125d4b47574c56c08034cb

Start time (UTC):	19:26:53
Start date (UTC):	28/12/2024
Path:	/tmp/wkb86.elf
Arguments:	-
File size:	116588 bytes
MD5 hash:	7a27473790125d4b47574c56c08034cb

Start time (UTC):	19:28:19
Start date (UTC):	28/12/2024
Path:	/tmp/wkb86.elf
Arguments:	-
File size:	116588 bytes
MD5 hash:	7a27473790125d4b47574c56c08034cb

Start time (UTC):	19:26:52
Start date (UTC):	28/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	19:27:34
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:35
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:38
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:39
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:27:40
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:41
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wkb86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6637/oom_score_adj

/proc/6944/oom_score_adj

/proc/7112/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1701889cfGFZi

/run/systemd/journal/streams/.#9:1701890gvam9i

/run/systemd/journal/streams/.#9:17018916IrkZk

/run/systemd/journal/streams/.#9:1701892sK1VYi

/run/systemd/journal/streams/.#9:1701893LbqSul

/run/systemd/journal/streams/.#9:1702003tjg3hl

/run/systemd/journal/streams/.#9:1702103JgXF0j

/run/systemd/journal/streams/.#9:1702163QDNIbj

/run/systemd/journal/streams/.#9:17021654heXbj

/run/systemd/journal/streams/.#9:1702299pTzV6k

/run/systemd/journal/streams/.#9:1702313GvD7Pj

/run/systemd/journal/streams/.#9:1702315Kg6yri

/run/systemd/journal/streams/.#9:1702492VNqMgi

/run/systemd/journal/streams/.#9:1702540Y5DCii

/run/systemd/journal/streams/.#9:393096et8pmi

/run/systemd/journal/streams/.#9:393097v5F1Ej

/run/systemd/journal/streams/.#9:3930983ZO6dk

Linux Analysis Report
wkb86.elf

Start time (UTC):	19:27:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:27:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:27:46
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:45
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:57
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:27:58
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:27:59
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	19:28:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	19:28:02
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:28:01
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75