Edit tour

Linux Analysis Report
fnkea7.elf

Overview

General Information

Sample name:	fnkea7.elf
Analysis ID:	1581737
MD5:	6ecc74633b970952196f941f10be5b0d
SHA1:	b405c075017f53204ec6d924c36d555a9674a370
SHA256:	152ba31ed8ed6767562adbf031039b446c9984733ccc13e9a7b2785399587f73
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581737
Start date and time:	2024-12-28 21:26:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fnkea7.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/113@172/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/fnkea7.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

fnkea7.elf (PID: 6236, Parent: 6159, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fnkea7.elf

fnkea7.elf New Fork (PID: 6238, Parent: 6236)

fnkea7.elf New Fork (PID: 6240, Parent: 6238)

fnkea7.elf New Fork (PID: 6242, Parent: 6240)

sh (PID: 6242, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6244, Parent: 6242)

ps (PID: 6244, Parent: 6242, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6472, Parent: 6240)

sh (PID: 6472, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6476, Parent: 6472)

ps (PID: 6476, Parent: 6472, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6585, Parent: 6240)

sh (PID: 6585, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6587, Parent: 6585)

ps (PID: 6587, Parent: 6585, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

systemd New Fork (PID: 6281, Parent: 1)

journalctl (PID: 6281, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6298, Parent: 1)

systemd-journald (PID: 6298, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6300, Parent: 1)

journalctl (PID: 6300, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6308, Parent: 1)

dbus-daemon (PID: 6308, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6320, Parent: 1320)

Default (PID: 6320, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6322, Parent: 1320)

Default (PID: 6322, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6323, Parent: 1320)

Default (PID: 6323, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6324, Parent: 1860)

pulseaudio (PID: 6324, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6326, Parent: 1)

rsyslogd (PID: 6326, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6331, Parent: 1)

rtkit-daemon (PID: 6331, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6334, Parent: 1)

systemd-logind (PID: 6334, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6396, Parent: 1)

polkitd (PID: 6396, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6400, Parent: 1)

gpu-manager (PID: 6400, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6401, Parent: 6400)

sh (PID: 6401, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6402, Parent: 6401)

grep (PID: 6402, Parent: 6401, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6405, Parent: 6400)

sh (PID: 6405, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6407, Parent: 6400)

sh (PID: 6407, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6408, Parent: 6407)

grep (PID: 6408, Parent: 6407, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6409, Parent: 6400)

sh (PID: 6409, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6410, Parent: 6409)

grep (PID: 6410, Parent: 6409, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6411, Parent: 6400)

sh (PID: 6411, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6411)

grep (PID: 6412, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6413, Parent: 6400)

sh (PID: 6413, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6414, Parent: 6413)

grep (PID: 6414, Parent: 6413, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6417, Parent: 6400)

sh (PID: 6417, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6419, Parent: 6400)

sh (PID: 6419, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6420, Parent: 6419)

grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6404, Parent: 1)

agetty (PID: 6404, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6423, Parent: 1)

generate-config (PID: 6423, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6424, Parent: 6423)

pkill (PID: 6424, Parent: 6423, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6425, Parent: 1)

gdm-wait-for-drm (PID: 6425, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 6429, Parent: 2038)

fusermount (PID: 6429, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6435, Parent: 1)

gdm3 (PID: 6435, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6439, Parent: 6435)

plymouth (PID: 6439, Parent: 6435, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6456, Parent: 6435)

gdm-session-worker (PID: 6456, Parent: 6435, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6462, Parent: 6456)

gdm-wayland-session (PID: 6462, Parent: 6456, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6464, Parent: 6462)

dbus-daemon (PID: 6464, Parent: 6462, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6466, Parent: 6464)

dbus-daemon New Fork (PID: 6467, Parent: 6466)

false (PID: 6467, Parent: 6466, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6468, Parent: 6462)

dbus-run-session (PID: 6468, Parent: 6462, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6469, Parent: 6468)

dbus-daemon (PID: 6469, Parent: 6468, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6470, Parent: 6435)

Default (PID: 6470, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6471, Parent: 6435)

Default (PID: 6471, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6441, Parent: 1)

accounts-daemon (PID: 6441, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6451, Parent: 6441)

language-validate (PID: 6451, Parent: 6441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6452, Parent: 6451)

language-options (PID: 6452, Parent: 6451, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6453, Parent: 6452)

sh (PID: 6453, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6454, Parent: 6453)

locale (PID: 6454, Parent: 6453, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6455, Parent: 6453)

grep (PID: 6455, Parent: 6453, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6501, Parent: 1)

journalctl (PID: 6501, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6502, Parent: 1)

systemd-journald (PID: 6502, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6503, Parent: 1)

dbus-daemon (PID: 6503, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6506, Parent: 1)

rsyslogd (PID: 6506, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

systemd-logind (PID: 6509, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6570, Parent: 1)

agetty (PID: 6570, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6572, Parent: 1)

gpu-manager (PID: 6572, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6573, Parent: 6572)

sh (PID: 6573, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6574, Parent: 6573)

grep (PID: 6574, Parent: 6573, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6575, Parent: 6572)

sh (PID: 6575, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6576, Parent: 6575)

grep (PID: 6576, Parent: 6575, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6577, Parent: 6572)

sh (PID: 6577, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6578, Parent: 6577)

grep (PID: 6578, Parent: 6577, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6581, Parent: 6572)

sh (PID: 6581, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6582, Parent: 6581)

grep (PID: 6582, Parent: 6581, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6583, Parent: 6572)

sh (PID: 6583, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6584, Parent: 6583)

grep (PID: 6584, Parent: 6583, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6588, Parent: 6572)

sh (PID: 6588, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6590, Parent: 6572)

sh (PID: 6590, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6592, Parent: 6572)

sh (PID: 6592, Parent: 6572, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6594, Parent: 1)

journalctl (PID: 6594, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6595, Parent: 1)

generate-config (PID: 6595, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6596, Parent: 6595)

pkill (PID: 6596, Parent: 6595, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6598, Parent: 1)

gdm-wait-for-drm (PID: 6598, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6603, Parent: 1)

journalctl (PID: 6603, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6604, Parent: 1)

dbus-daemon (PID: 6604, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6605, Parent: 1)

agetty (PID: 6605, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6608, Parent: 1)

systemd-logind (PID: 6608, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6665, Parent: 1)

rsyslogd (PID: 6665, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6667, Parent: 1)

systemd-journald (PID: 6667, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6675, Parent: 1)

journalctl (PID: 6675, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6679, Parent: 1)

gdm3 (PID: 6679, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6682, Parent: 6679)

plymouth (PID: 6682, Parent: 6679, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6696, Parent: 6679)

gdm-session-worker (PID: 6696, Parent: 6679, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6704, Parent: 6696)

gdm-wayland-session (PID: 6704, Parent: 6696, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6706, Parent: 6704)

dbus-daemon (PID: 6706, Parent: 6704, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6714, Parent: 6706)

dbus-daemon New Fork (PID: 6715, Parent: 6714)

false (PID: 6715, Parent: 6714, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6716, Parent: 6704)

dbus-run-session (PID: 6716, Parent: 6704, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6718, Parent: 6716)

dbus-daemon (PID: 6718, Parent: 6716, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6721, Parent: 6679)

Default (PID: 6721, Parent: 6679, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6722, Parent: 6679)

Default (PID: 6722, Parent: 6679, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6683, Parent: 1)

accounts-daemon (PID: 6683, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6687, Parent: 6683)

language-validate (PID: 6687, Parent: 6683, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6688, Parent: 6687)

language-options (PID: 6688, Parent: 6687, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6689, Parent: 6688)

sh (PID: 6689, Parent: 6688, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6690, Parent: 6689)

locale (PID: 6690, Parent: 6689, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6691, Parent: 6689)

grep (PID: 6691, Parent: 6689, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6692, Parent: 1)

polkitd (PID: 6692, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6702, Parent: 1)

systemd (PID: 6702, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6710, Parent: 6702)

systemd New Fork (PID: 6711, Parent: 6710)

30-systemd-environment-d-generator (PID: 6711, Parent: 6710, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6727, Parent: 6702)

systemctl (PID: 6727, Parent: 6702, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6728, Parent: 6702)

pulseaudio (PID: 6728, Parent: 6702, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6708, Parent: 1860)

dbus-daemon (PID: 6708, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6709, Parent: 1860)

pulseaudio (PID: 6709, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6713, Parent: 1)

rtkit-daemon (PID: 6713, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fnkea7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
fnkea7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6236.1.00007ff674017000.00007ff674038000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.00007ff674017000.00007ff674038000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: fnkea7.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14e51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14edd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ef1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fa5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fe1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6326)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6506)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6665)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6298)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6464)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6667)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6679)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6706)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6718)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6702)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.38.dr, syslog.137.dr, syslog.195.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38346
Source: unknown	Network traffic detected: HTTP traffic on port 38346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007ff674017000.00007ff674038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4493, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4498, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4503, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4524, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6065, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6308, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6321, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6331, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6435, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6441, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6472, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6570, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6585, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6587, result: no such process	Jump to behavior

Source: fnkea7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/maps[killer/maps] killed process: %s ;; pid: %d

Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4493, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4498, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4503, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 4524, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6065, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6308, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6321, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6331, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6435, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6441, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6472, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6570, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6585, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6240)	SIGKILL sent: pid: 6587, result: no such process	Jump to behavior

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007ff674017000.00007ff674038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fnkea7.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/113@172/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6308)	File: /proc/6308/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6429)	File: /proc/6429/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6464)	File: /proc/6464/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6503)	File: /proc/6503/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6604)	File: /proc/6604/mounts
Source: /usr/bin/dbus-daemon (PID: 6706)	File: /proc/6706/mounts
Source: /usr/bin/dbus-daemon (PID: 6718)	File: /proc/6718/mounts
Source: /usr/bin/dbus-daemon (PID: 6708)	File: /proc/6708/mounts

Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:759600M0ccs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:75961x7bERr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:760968PEvwr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76152d3z0go	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76159Cs9Brs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76356ZhhYcp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76357NFn7qq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76373fXWF6p	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76639TBm7ip	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:76737MHf4Qp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:77854YRnNVq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:77959W2xk3r	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78083xUTpns	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78109oZo0ss	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78160xpQSvo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78162fFf4Nq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78202nOejIq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File: /run/systemd/journal/streams/.#9:78204qbDUFq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/seats/.#seat06ha0xa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127U5GzB9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127yeiTB8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/seats/.#seat0VZ7Fh8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127nFeQN7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127erY128	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127qCD2L7	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6396)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6462)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:78755W6hX8Q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:78829qbhSPS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:78830nz0dBS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:79873vU7DgP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:798744WBZ3Q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:79883W6y5sP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:79884YcvZgR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	File: /run/systemd/journal/streams/.#9:79965uwBAXP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/seats/.#seat09dFHUo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6608)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6608)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/seats/.#seat05GfeoS
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127x2a18P
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127YPM0NR
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/seats/.#seat00ViiCS
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127DV66QR
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127EcSd4T
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127YwyFZP
Source: /lib/systemd/systemd-logind (PID: 6608)	File: /run/systemd/users/.#127xn3XAR
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85632RqlVVl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85633NiZxIm
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85641dCmD1k
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85650UGV2dj
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85651W3J2ul
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:85734sgP3Rl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:581091YvO57h
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:581177hGwL5l
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:581285emTutm
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:581333vEk9Xl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:581335Ra1NTl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:943160LDabQk
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:943173uPkbwk
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:9431754ZqO8j
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:976296Xuxk0j
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:976334zUmUsl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:1090249V3lIyl
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:1287710a7pp0i
Source: /lib/systemd/systemd-journald (PID: 6667)	File: /run/systemd/journal/streams/.#9:1287758tzeMzm
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6704)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6683)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6683)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6692)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6702)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6711)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/6396/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/797/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	File opened: /proc/2025/cgroup	Jump to behavior

Source: /tmp/fnkea7.elf (PID: 6242)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6472)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6585)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6401)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6407)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6409)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6413)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6453)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6573)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6575)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6577)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6581)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6583)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6689)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6402)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6408)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6410)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6414)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6455)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6574)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6576)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6578)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6582)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6584)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6691)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6424)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6596)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6244)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6476)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6587)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior

Source: /lib/systemd/systemd (PID: 6727)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6244)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6476)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6587)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6667)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6404)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6570)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6679)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6679)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6683)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6683)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6326)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6326)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6400)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6506)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6506)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6572)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6665)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6665)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fnkea7.elf (PID: 6238)

File: /tmp/fnkea7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6400)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Source: /usr/bin/ps (PID: 6244)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6476)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6587)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6324)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6424)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6596)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6728)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6709)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/fnkea7.elf (PID: 6236)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6298)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6324)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6326)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6400)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6404)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6456)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6502)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6506)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6570)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6665)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6667)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6696)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6728)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6709)	Queries kernel information via 'uname':

Source: fnkea7.elf, 6236.1.000055648d1fa000.000055648d34c000.rw-.sdmp	Binary or memory string: dU!/etc/qemu-binfmt/arm
Source: fnkea7.elf, 6236.1.00007ffed3f7b000.00007ffed3f9c000.rw-.sdmp	Binary or memory string: dU/tmp/qemu-open.iscuyL:
Source: syslog.195.dr	Binary or memory string: Dec 28 14:29:20 galassia kernel: [ 564.955327] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.38.dr	Binary or memory string: Dec 28 14:27:58 galassia kernel: [ 482.628202] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.195.dr	Binary or memory string: Dec 28 14:29:20 galassia kernel: [ 564.955345] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: fnkea7.elf, 6236.1.00007ffed3f7b000.00007ffed3f9c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/fnkea7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fnkea7.elf
Source: kern.log.38.dr	Binary or memory string: Dec 28 14:27:55 galassia kernel: [ 479.825332] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.38.dr	Binary or memory string: Dec 28 14:27:58 galassia kernel: [ 482.628127] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: fnkea7.elf, 6236.1.000055648d1fa000.000055648d34c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: fnkea7.elf, 6236.1.00007ffed3f7b000.00007ffed3f9c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: kern.log.38.dr	Binary or memory string: Dec 28 14:27:55 galassia kernel: [ 479.825350] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: fnkea7.elf, 6236.1.00007ffed3f7b000.00007ffed3f9c000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.iscuyL

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6683)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007ff674017000.00007ff674038000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007ff674017000.00007ff674038000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fnkea7.elf	43%	ReversingLabs	Linux.Backdoor.Mirai
fnkea7.elf	40%	Virustotal		Browse
fnkea7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.153	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.38.dr, syslog.137.dr, syslog.195.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	dlr.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	wkb86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	fnkea7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
raw.cardiacpure.ru	kqibeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	kqibeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wkb86.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	fnkea7.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
CANONICAL-ASGB	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wkb86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6467/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6715/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:3vn:fn
MD5:	ACA3A00C230C98418FC2A445A5C0455C
SHA1:	F3B71427819A01A05FDE990DD49A88C546D82E43
SHA-256:	77122F772E3DE5D801703818782FB17324D0B63C4213C804BAAECAA7E939142E
SHA-512:	3D5752CF15053120A712B95BF2C7CB35FD83F34E00C45931E10B601E9E464C6A8CDF43126D35F9D27A5A5AF334BE223BD715DF1CD8FE1473658226B5C75EB1E5
Malicious:	false
Preview:	6679.

/run/systemd/journal/streams/.#9:1090249V3lIyl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4495008123563835
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu5HAUvHGBkd0jsjOA:SbFuFyLVIg1BG+f+MuTbejNE
MD5:	FB0F4AEE40A6046518C33157B4F8FDAB
SHA1:	AD708C29E557CDFB76EADA851ECA81B777357EF2
SHA-256:	556F0FE4CA82B836CEE1672F190506226DA2B2001E98280DF6DF0482E5AB1A2F
SHA-512:	A30D4F05ABE2B8700B1EC5666EE026A70DBA474F17FAFDD5AB02C2D17B352CACA0203B58CA7C9288F99BC30C3D2DA9A2D870C5525D1F956597BA087CEA0079D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d8ae04bf42c54f7a89157bec6bcd4418.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:1287710a7pp0i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.387752947238075
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8S3SWVAHg02lsjsiI:SbFuFyLVIg1BG+f+M8IU22jZcHjv
MD5:	BD659F9C2CB7F27EF4E617BCF0F1B69B
SHA1:	3A4BACE98A08116518F3D702B2365F1BBCAE512A
SHA-256:	2AB566D6745C2180380686C6603B61F287E778A26E7DC7C492AFD89F31D6E24D
SHA-512:	134616FF0E0F117E6F186B8128BBA63EFDBD56222E423F7C8915441F9F598CB3E07DD69DCD10CB6D2182BDD3A17A3F5FE5222E94414C27B331F9AE660B80850E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=63a8ade7751d4c568bc66dacf9b2d3fb.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:1287758tzeMzm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.326780702691527
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy4HwA9ddoGBEbuqjt:SbFuFyLVIg1BG+f+MyKwMdbyCqjtWL0
MD5:	D0C3B7147624E594C56C46DB0EF93D9C
SHA1:	C852AAC4A09903BDACD4586268FC9DCE1E7711C0
SHA-256:	96EB0CECFE6BBD5DD35B6E063FC789134C58977684ABE79B3247D3F2DA567CF7
SHA-512:	998FFCEACE5C351869F04F179CB99250364783DA9171B2FAC831B404DC31D55CAA67C0F790614759FE75DC8A465A5617C39C879D2E2E66E9020D4025BD80DC47
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c4428bdc4de4ecd8882399ce72da689.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:581091YvO57h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.42624743861104
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9GTEESeHDAMiAglsS:SbFuFyLVIg1BG+f+McauAZ8jLkGq
MD5:	88380D9220C56DC2AD5972F8ADBA8F6B
SHA1:	0D17BFC3CCBBA31019E4AB3029B26210D90D0BBF
SHA-256:	D3514DF4A99575B7ABAE63F68A97D22EAB1101B8D9F9117D2D91387BB12B0209
SHA-512:	E48041A20B4A46B5C7A26B9940B8ADD993859B6663A361557FD851480372C5C36DA385BC5696CFE0FBA5F6FF5D2732311A4C90D5E7A60F0D48193676D667D9CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7236ce13f6924076bfeba60d6548d27c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:581177hGwL5l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.3858907269288
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmytQdGThUSYuATjswq:SbFuFyLVIg1BG+f+MytIKD8jLTTIWTIL
MD5:	058D971180450548C8965A294F495BBA
SHA1:	49B2AFA4D717169107557F9EA019FFAB92878726
SHA-256:	0ADA37621F35DA44BDB1AB742580CB6840481425C31F6406E851E3DDDF42AE98
SHA-512:	96E6F03C01BD69F27A9B6FEF93D59055AD272D5D418D4DC27A68065527FA02EDC460DD7A01C0A5365EE80F620F448296567F24EA99FF37E6170FDAC4D557D543
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=85d6a83958c8450a9fee028e8108284e.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:581285emTutm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.407665708880355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsQGR2X0hg2jshKJv4:SbFuFyLVIg1BG+f+MsB22jbVC
MD5:	6CA76BE983FAA7768F59F43875084F19
SHA1:	93DE396798CBDFB836FD79C1276C3FBF7C326E6D
SHA-256:	39A4454B35233E4854F4FA6206B7887E7D93F48142322D16D382D735CAC7D888
SHA-512:	1E982DDA793CA1B11E1568A738C04CDBCDF0C9C4E0448E1BAD68F1C8005191DB06E343CB4EC457497A264B2ADEF361C7FEFFD3B0D2C213FC4FC6169048EFB1D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f04ff2af2c8e418c9bfe648636f2f5bf.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:581333vEk9Xl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.402458049899299
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6lVXAM18js2BDf8:SbFuFyLVK6g7/+BG+f+M63AjjNq
MD5:	B9169DD36CC2CB14A478D58CEE1B69C2
SHA1:	A3BA08D720909984378ED86E698FD4A44C4E45FD
SHA-256:	86B8816B1FFB7EB671E4D487ABE1389A3D1AF4E5CE349DD415A88569F2D18C2D
SHA-512:	2785C3F3EE2BBEBC0B04925461F990F1DA700B9E0AB48249B0A19B54CD88FA279EF0E8348B8C3C057AF75C86012DE9FC6366260C869643E159B34FD474E34CE6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=023ad5ac7c004e469e8d33e31e8c575f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:581335Ra1NTl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3835170575221545
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmydyO0wwiQYUvswb:SbFuFyLVI6g7/+BG+f+MydUzY2sZjNq
MD5:	37957D031DBD1F81C711166D7F0E96C1
SHA1:	0AF07B41A27E1312F4FA1A7A96F8B5A3D802032C
SHA-256:	8CC76C5BBEA86EEA13163E267F76AA468D201B6E2C7944909A001DEAF3E66A9D
SHA-512:	A556C85554B9A2BB6BB16599F1CF29676A4C1BB066162293BFA0BA625137568FC3F3FDC7BC8E1D80D1EC2CFB17924677AF006C23740BAB5E0525EF464961E03A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8a456a46a5694794b55d355fbd1553a1.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:759600M0ccs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.50033972509093
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoCsQHgVDxc2js7Lbr:SbFuFyLVIg1BG+f+MoCTQDFji4s
MD5:	521BAE81CB5BC99B1F21C9B29650A844
SHA1:	0D8BE02224FF66B8A0BEC2B773EF416A37B1065A
SHA-256:	91C6B6A48AEB555F32AC14FE3CEE8FB2601E0A3091677C881CAEED9AB4599647
SHA-512:	EC25143723188D45A55A1AF750F72AAD9826185DFF87140B7CA2BB72B602F17264C45DE052A74926DA1F8AA1A7B186551D5F2505F644F8FEF7E87DDC6E0F807A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b8e0cce285fe4e539a5130cbb70b1057.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75961x7bERr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.494684456351737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuoWsB9th73sZjs7LH:SbFuFyLVIg1BG+f+MuoW29XsZji4s
MD5:	4DA251DB2810DCBA0A7B40FB46F4BCBA
SHA1:	4FF7AB94753360690F202F229856A75B1AA1187F
SHA-256:	77EAF2A7E8DFF3B28815A43B6C692EF0EC28688A00E5A8CC0E1458A7AA53386E
SHA-512:	11F05C43B725A80E34D36794359FDAFD5D9FB13696F2F70EEBE3A71911502D1101815B17ADC596ACCC18BF2070A32BA9EA0CDA67A867B293A29A4DC9FBB28439
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3e6a32033c7454caa5d23389ddc87fe.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:760968PEvwr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.431188102263819
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7ZVVMQQUX47/WwdvE:SbFuFyLVIg1BG+f+MJI/W8vRqjosQu
MD5:	202274E767C1C1E9103570DF09518724
SHA1:	AE63B534DBC53514B16C30531B53FB9BE82E5D99
SHA-256:	951DDCCBCA316CA39ED7E64432837A7089B350A95B13C24E9808B1F75D09D215
SHA-512:	B2FD570605DEEA29DFDCD082EA4420C958D44166EE0B44757D124AE56D64372BCC5F20B4777C1F1D8B2833FFFD4809C87703F104662A25272504494318599CC0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a5b002955124962b17a33c20c58ebfc.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76152d3z0go

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3537467156192955
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MaKGHVeUEDCZjdCLKzK:qgFq6g10+f+M3EEG3CLAK
MD5:	1C1645FA26D9291606E905E45F1A0872
SHA1:	621ECA7D9244B756037BB28C0A9F7880293F23A1
SHA-256:	6DE02833653C7EB3A8911F44F282133DA9528E2D2473F327E996193D6F6F5C99
SHA-512:	42DCFF5E3FC323677B9CA11E5C6BB85CB34ADCCAC3B76745A3F053F1455AAFFE3D6A07D27B9BB38B12FD3326979BEDD32CBCD7A6041D48D0DD2E0CADB323CFCB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=574bbe9d7b1042acb037d0c5a1af1171.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76159Cs9Brs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.386717937181636
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm45fbXCcRdqzg2jshQ:SbFuFyLVIg1BG+f+M4JRkM2jtWL0
MD5:	83AB53C1B861C9C55F7F199E0A1E0D21
SHA1:	24A4B8CE52A49E6B93C498F06478DEEA225E7B33
SHA-256:	03FB45AB84A207FF4F49A64A771E79B100EE66D6ADEF072F8DDB526910390E55
SHA-512:	7DEC2AD79001848A96FED80C72282E09BD00B84CC9516B9E174F0AA5C5D545563745377E2377426CEB0D5C625BBBD8E2DE91C5EF225B384E2031ADB3B438C37C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2066486bd99c4ec092d852c7f3908427.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76356ZhhYcp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.417164626685946
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrzGSdu4FOTjsjOdlE:SbFuFyLVIg1BG+f+MeShFOjNE
MD5:	423A446FE01EC06531B07B10D42FEC6C
SHA1:	128513ADA438DB92CB0C6D7FE1D24883FE86AD86
SHA-256:	526C7DBEBF1C87F851EA9044FCAB56030328B12CF04F5CE5611C3C0083ECDC67
SHA-512:	613B9CF4CF4609FA53DD0E602F7EF4ADCBDEE87E64C3B72984CBC866C17C0370686C81435E053A584609461B9B80E77B3916C28E8836B472E146C950A5F00F3E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a532bc7854824b82b90c708018083aa4.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76357NFn7qq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.422760602773491
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MRdln+YfjZcHcljX+:qgFq6g10+f+MzldmAu
MD5:	55D2C0020C684091203E89FC2E1ED051
SHA1:	FD06296BAE9A84BD5269A7CD05B820540ECBE63F
SHA-256:	E54BDF6459BF81A1E5FA6DB30049325A04C6BD52AFC81561328A91602784135D
SHA-512:	7B7CE7208512E09D911B5E3BE56D54543C836D47390D3084357DEC9220F29899B4BF08A4156142562D8E2F3E1C17087DDA00E06FDCEA14F62A756550BD9F92E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f20c293809f4051907d300de010051f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76373fXWF6p

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.410247782114408
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4ALFSKVRVdsBQNvXN:SbFuFyLVIg1BG+f+M4AJVR3so0jbVC
MD5:	8D46E3DE3D6A38362EDF0BB88EE43ED1
SHA1:	C49E34F1C28EC4B131BF90FFC05AD1B3A2826FAF
SHA-256:	404AF351A838CF3DA6FD0850940C1737DB1A0E1D13F9F0358B863D70FC2B1D1A
SHA-512:	73E407D0C357C9FEC6816608FBDDAF46265C6B1E3AE645792AF941BB41D8406BC52FC657E1A1511F5FA26DC1A0111BF9519A9CD3A0ED2E805B2F1B4D74AA6B59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=23bd7f51931f403c805a082c4950d511.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76639TBm7ip

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.419546721882672
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsE8RtBEqnin5VRqjs2o:SbFuFyLVIg1BAf+MsrRz6nRqjNALyAZD
MD5:	AC8D9D634EC1B116DB20B0E45331681D
SHA1:	98D6ABC6C66455685AE68E1E89418B37353F4EA3
SHA-256:	726AFDA739741CAC204DF14A811F51050A85F9E4F4F82B90E661A6E2B3CD7046
SHA-512:	DB8D0DCEEABA6F05F3D6CE2F1C8B220DAA6D1D72ED4C31D8589D2A8D0D7485388393D300E9B7293FAE57AA178A3FA9254BB7C27489A07E21E9553856C88944B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fa1ffd499da3437a967c4debd8f4e955.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76737MHf4Qp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.449981209875397
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsXdGFsDbSDcg2js2BbM:SbFuFyLVIg1BAf+MsdYcg2jNdQIeXD
MD5:	53F3A8D06BFBD514174A021AE63CDBBE
SHA1:	D8AA258A352F80109CC0090B626E731BAB44B1F7
SHA-256:	26730661BAF2F0742175D87379D6DEF64A443C26E541706A06E109D27E06C54F
SHA-512:	3682EA1AB85BBA414CE538E841ADC20C60C8DC00434BB10684180D0CD3B363FE99974495A0EC088B135AFBF72379A2E64D18B9874694BB26BBF73F054691A439
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f6e38cf5aa6b4544bd564fb7fa88ac65.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77854YRnNVq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.389662628637786
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DDRBlcuV399rqjsV:SbFuFyLVIg1BG+f+M4DBcuVN92jLkGq
MD5:	8B030AEF5C9B98F32B841CE1E2566032
SHA1:	57EBF56C487DA0627FD7034AD55250EAA770192E
SHA-256:	0CB57DCF680020D997AAA6556A2BDC262B137076AFAF80A0D7AC89AE95C68E3C
SHA-512:	BC3D3077ED0F1BA3EDFA90F38EEA0611D1BF26817538F691D48CE6E4BD3A604FEA4AB8A0C4C457EA2D3F816EE51D5C6E89900009EEB686CB8D625B7C08C4571F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2f8f82dd24de44d19ec70871d02cf36f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77959W2xk3r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.455367517610752
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+ocEodZjdCt/rRMtq:qgFq6g10+f+Mdod3CDL
MD5:	94B30801DEBC1B6D1E599551C6410BA4
SHA1:	7ABD2C0C130F5E54A938608888DF443C4AC99571
SHA-256:	F4489C71FB4C34FC3D335C4ADA548D17F0EB6AB61300CFED892607C3EF1D7D38
SHA-512:	0D9E2E9855E78333527EF3BAC3BCB3EA2BEAD62A54D0F0A75DC80BF0563C1056E17DE20D45F9EE885040B828515A7430D62247F8491685C0FCC9DB1484D561B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=470d8044a5494289a2a13f59eb9c690b.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78083xUTpns

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.428296542294138
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8mcy8HASHNrqjNTZD:qgFq6g1af+M8mZ8HASHNMTZD
MD5:	37D4B670E8667726A39F980D60B84F78
SHA1:	7537EEAE52D2F3EAF5640900A3EEAE4495418F3A
SHA-256:	7C4F1609495E2ACA3158DF26D2F3A45C6FFE9D04B76C39E23C01FDDB472E06E0
SHA-512:	A18FC64D2A5E9AF78A8E1CBE610863F4E052F6BDF89119044BA4BED158671C0E5A031B0F730B6AF7224EA34641BB3D8A74366C52C5C89EB07237CE7C85624BA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=67065f4092ca4d3f9b5b3b5bbd989c4a.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78109oZo0ss

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4051132785916325
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MugXuiGZ2jLTTIWTIL:qgFq6g10+f+M1TGoEWEL
MD5:	8E61AB89134DFB2BD661F7B6C0E826D4
SHA1:	D51E33220BAC47DBB8B13C617571193E797D9751
SHA-256:	FE017690F6CD4CD768206FFB2A8C32197D75C750993197CBB235F677F4F29020
SHA-512:	E98C544AD7067A90CA5D616ADE82842818A3D691F97EA9129557025506ED7DDD8BD01F07D69C258753BE7C4595597921C27CA077AD5D6FAF76DFAE1130D73189
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbe282dacc6641b9becfcb44b289104c.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78160xpQSvo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.412334799021623
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6gQbUBHRGxLD0Xb:SbFuFyLVK6g7/+BG+f+M6gQ4R0LQ8jNq
MD5:	35465372796D25FC9E8F0A3DBF7BB4C8
SHA1:	316520DA6E53FEE29739E4BEDCF019A5601A8581
SHA-256:	FC6A790D8915851D7E9DE6E0B125C4448C1AA078B0A83612C3C358BEEBD9D822
SHA-512:	75C78FDB2E260B4328AA351AD9780C78B08DBD7363CDA0397F09B47BB5DBB28964B889975538F088FCFD28D129A964E076FF55F92CAB47B0957EB93D8904BFBB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0945391d285a446e89eb0d244fbbdb0c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78162fFf4Nq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.426974557853792
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9t4CGl1XWlsjs2q:SbFuFyLVI6g7/+BG+f+M6bpjNq
MD5:	BEDAA662CEACB28CF252F180E0F90CF0
SHA1:	3287AB1CFE4B0C971E9795B51FA3FA0EB719E888
SHA-256:	3499869D030F21E9E52FDB9D7CAF099091C11E71E6510D9EEF4E1F820281FB8F
SHA-512:	30FAFB77745D30DB0670B557E346AD13703745E947707B6ECB63D9CEB6CCAF68EA38EF25B5E359302A7746757DE59756729833405366C51B3925D31185BC8A45
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=70b82ed6898c4437bb9d6cd07b9f0f32.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78202nOejIq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.502794728239635
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MysGilXT2jFQMzKaBu:qgFqo6g7/+0+f+MoiCTmh
MD5:	60BF0D7B24A6DC641F02971434E5A025
SHA1:	9EB201A74D0FBF324B4928D76D0A1111FD1EBF96
SHA-256:	77349A4A2251776934999E2C66DCEE498E4722A5D70A58AEFED8529B82B09A27
SHA-512:	3C925EB9ECAF5EC7277C0A7399CE3BD3FE53C97BB586C351B21258178B9B8CCAC9D2B0A555FB668EE25839BDAEB9CAB2331876C5C2BFD8D576419C510F3EA412
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80c1382d9c5b4fba86a444dbb11caa2d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78204qbDUFq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.481509305003748
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6wfanF98jFQMzKaBu:qgFqdg7/+0+f+MJanF92Tmh
MD5:	3D178095BD406711929C140C5D86BEE2
SHA1:	606FEB54236656F5550F907A3495C9E391E31735
SHA-256:	2E19AFB59D843DBEA5EBC18027E6257DD7AFF957A7B34A401875EEAA136979B3
SHA-512:	DFAF98730A91036A0BFE7FE514F4022CCCB71269EDF7468418139548A7D1768E418DF8B1F653B38F863753C53AA4FE5F711E7C1A77D47A8A22965528671A0556
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e00d2ffc7504f65bdf56105083e4a01.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78755W6hX8Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5417976286686725
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoH4+IhNvzGuxsjs77:SbFuFyLVIg1BG+f+Mo4vzGuqji4s
MD5:	E7E6FF94DF11F2D4E67245DB3AFF4A63
SHA1:	8B937A4ED8A9B4A33A8B0EA4ED24C1FB8A237644
SHA-256:	6311CA8FE203F3310DD91A60577AE96C520B23C52ACB42EE43B5CE42F13A1CA4
SHA-512:	196D62CC717E05291D9034233CE6448DD45205332E9AD7D1CD559EA6D0CE45213F52179D15453B3CB7A90B048AEBEE47C19983B31B954393E47C4DFD7D8A0222
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b22e855ad31f4717bd2119b566e5a99a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78829qbhSPS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.432479920955362
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9IHHnUDA1+Xj8js16:SbFuFyLVIg1BG+f+MGnUDVz8josQu
MD5:	56B454A2D28614D5ADFB3CE589C29895
SHA1:	D7667276BEDF99FDB67B85A10105787BBB4AE0BE
SHA-256:	AC55FD852A6F65A645ACB1F48E8B75EFE1E102B593674A83D1B2B6A3FD9EDBC9
SHA-512:	45EB797E3FFF187E8F0C2208D342F689DEE9BF4EBF852DB3DE0A8623EAC480446FDF475BAD817B4BDC4E2A5D3D88736A1EFDA6B2C28E87C7AB2C72892BBDCF0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=76dc5cbca9b745c5901fe2e395371d26.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78830nz0dBS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392409427061442
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsgqRyrp7qjdCLKzK:qgFq6g10+f+MsuVgCLAK
MD5:	EA720FB52ABCFEB7A869058C47D2E9C8
SHA1:	A08BE36D4222EBCA66C106396238E8F4B5A2EB14
SHA-256:	39B3722790A04894F1C10FFD46E26D5912E9C83D03B8E16656D5341B6CE739DA
SHA-512:	1877F6A4B0CD899EE8350DBFA9647C7021A0D9B46441ADC86219892A1833C049D3753EA5C7C56C106B01ED5AADC4F4A76A89B7211F291F3975EA0FE0101C3B6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f94b8f15a96544fa824ded90f5740ba9.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79873vU7DgP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4739452273296125
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvW8WKcEb0MqjsicWg:SbFuFyLVIg1BG+f+M+qcEYZjZcHcljX+
MD5:	B6F81B13FCABA0AFBDD8558656760FCC
SHA1:	DF9F49A5535AD4EDA0521FE2543C8BB3AA243E22
SHA-256:	28B5B3D52ED4BD54C487BBCE9692C61E3AA2DEC4C03AA8984B568CAA5A3DA87C
SHA-512:	E4F97B2752CB37794306CE646EA78CB5F077DC918570F1D058F839CE30AB115C2680F0588A7224EECE4F8F703BD0C4DE929E96A0BCC1FF2D7D29D46F4FD16072
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e344f5f4382241bcbe22305e7f8e27f4.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:798744WBZ3Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.516266267621394
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp5VGciFdXGjqjs7LH:SbFuFyLVIg1BG+f+M0BXGjqji4s
MD5:	546E076ABA493381A85393F7E6EEBA99
SHA1:	4A180CC464C5117550100289019ED9B35A770233
SHA-256:	CC8944C9F6576A7A3AE143812ABF41DABBC877B8EFA689B49AF8CE6C1EDB4BC9
SHA-512:	B95C768DB4B880E8152BDBC270EE8DACA37BE517867F5907AF1BE79D834B362C4FE29DDA173FF87CD89AF346B8DAD698FABAE46E2CBE37A83BD36958E2F72DA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c150e37703d94a48abc406859b19cd0d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79883W6y5sP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.378971078004676
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvK3ymGRxfABSW0hglsi:SbFuFyLVIg1BAf+MCwkSx22jNALyAZD
MD5:	07255991CF301C1D7A2B4BD2CAD7728C
SHA1:	1A14DFCAD9681924D53F6C32C94E7B0CD9560108
SHA-256:	CB7BFCC96B7ED6913D934C812EC296E01D25F17C47ECC45BD570EE9AA7270B10
SHA-512:	E84F57A3EF5B59906FA49FF6319BF4C4E637D18BA42DD8EDBF2FFB625DA557FB9766B31261CD641A579938E6AE44D3371D25F54FCD0427B47FFE3C2B41CEE59E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec8b2e24eb704332bbacb50de11d0d03.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79884YcvZgR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.423813604828941
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4TkhR5S4BH6IjswkT:SbFuFyLVIg1BG+f+M4T6R516IjLkGq
MD5:	93E749EEBD7AC7914E7D5498E6A516EE
SHA1:	79961A858C9DF5FA019F3E1597900E63699D58EE
SHA-256:	BC734E39BC77B51D97EC205FFDA780F424B217F8037A38212B5C96E885A55D7E
SHA-512:	B7990B5563AAE495EF36AC2473477263BD7593F9D58C631B96DE69265ACDA7E76D70400068155B0435165546D027039AA9F15656A79B86AA06A6D0D768A8AFCF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=230de7295f554d669c6871333c3cba66.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79965uwBAXP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.468144522676159
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M+osWHLRARTjNdQIeXD:qgFq6g1af+MV3HLRA32D
MD5:	9C196315334F860BBC31F09BE1EAB2EC
SHA1:	305741EF9A01EA92137B393FF50ED338D10DAA9B
SHA-256:	AA3CB67FD54CC112D0F53312C86377F6601351853CFEA35339121F18B0444BA0
SHA-512:	738CA609106AF19F94A22BAA05FA167835DE31AFEFBD7A8BD8DE76E808E763FAFE057DD2D44271E42FBC4B1D12DE85492B59BE5D0ACEF08D1D070614FF29F525
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=441e5d88fa0b4263bb1d159b4773bdeb.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85632RqlVVl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.504983502847242
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8BBFKKTwvTDHxGA+3:SbFuFyLVIg1BG+f+M8BmlvToATji4s
MD5:	66DC1B1DCA57F5DA69F2EEFFFDCADAAC
SHA1:	B5221C73E61BE4FDEFA86FEDF3A697DCC9FE51F7
SHA-256:	E1F3AAAE7C65A32D1655C5572886AC02EB92613BE276CA67A5AE45E620C0269D
SHA-512:	A55850B7C1ADF969B6696E89A04675A6B355BD717D486DF12B6BB950C359D935147B83C11D6A192EF08EF7A22F04323E9BED296F9A57D18DF014432C3FCF79AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6dd0d4c8c486409da0b506adedb74721.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85633NiZxIm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.374991348347197
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/dscpURBwKHXZcldj:SbFuFyLVIg1BG+f+MF9BK3UhTjosQu
MD5:	6517C0072AA62C98C5FD0B9A49170750
SHA1:	959715784270B494E27B38AE4E29AD53FD4A05D3
SHA-256:	2B88CCCE6155EFE57566C638FC8AF2F6558282B03827D310D71BA700AD3777BE
SHA-512:	646498ED6185E2593E0858E5864A457781954F6231EC5970894CB6D2912360FF9A6E503C12B187BA04F12484007B0FB15BB7BB6A3C465B633A562E7C21DBEC5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=50001ca96b814d9d9a500bead7699737.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85641dCmD1k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4726983339419935
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoAg3fahEQ0jsicWmt:SbFuFyLVIg1BG+f+MorPan0jZcHcljX+
MD5:	E359D59D2D15AD4C3F3F3B79AC2CBE59
SHA1:	1ED6F690809D0CB94A9FF7970CDD96D2B92714BB
SHA-256:	489DA17A4B7843EF12BF5AD919DBE70F252A0DC3494174308FF3CF50DD41CB0C
SHA-512:	9305889CEB432567A62E81DEC42752A2A5AB71890755C6B8B7145331D9C305AB71CF8973EF4CFDD1CF3E534FA804D3CFBAE4956328C199474B525CE2C42F6644
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=be1a25d35f5a4d07976aa733fc0b63f5.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85650UGV2dj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382995215426665
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MBpBKPg1SnjdCLKzK:qgFq6g10+f+MBvNY5CLAK
MD5:	27E097E39C21ED587A2A03F8D217E185
SHA1:	96448E5069FD2E80012194E860BEE8D0EBCE8124
SHA-256:	2B32DFAF5BFB515FBC037771E5B71069C00BA5711402A20B6D804F3455A1CC3B
SHA-512:	C421C96A1747839C52EC6B7034D06A1FF06B4F7A253AB20B39A55CB232BC1425566F3FE1F5325AEF47170521D0AFD380DDA36A4400A97814E1B0F2D4681C8559
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cbf7a32a60cc4ddd8e6f6b92ce2a979f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85651W3J2ul

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.523672767771963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7DM86QVjFTVMqs22+:SbFuFyLVIg1BG+f+MXv66VMqF2ji4s
MD5:	1EB321FBEE41A0F5428660CC67CD1D2E
SHA1:	06116E8D2B78C95F7DD952302C25C21C5DE5FC6C
SHA-256:	C34B37021647E73BF81EE70DC870F204B7E27D15822093CA3DE4D0FE5805B03F
SHA-512:	90A9A38F361942399DC850C9C99638B965AFBF869E5410A1B5FDE3A70BD2801E8544F748827EABCE467BB2D54153FC0E60F46AB10CEF032D665982C09B0C4362
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1bd010f31a394950b1fc419682d292be.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85734sgP3Rl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.390348708202211
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7d7KRWAXc3nBB/Flsjr:SbFuFyLVIg1BAf+MJ7KRs3nBB/8jNTZD
MD5:	D99027CAA8386939CD707DD3F9C4B7DE
SHA1:	5B8B9669C35D9AC225A7CE0176B52C7185987338
SHA-256:	B84E252BDD6FDD72ECD7014B9328CB7499F2D57AD4EBAB802B3738C69DB24F8C
SHA-512:	A234D87699DFB638CDBB6B970EF0F02CA4BC0C0F875B0795B21F4E873E89BB37A56A5EE87E43860B2D0547E503E82204069844FEBF79D690A628DAC397FFFEC8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=11ce49c7d79743e29572fdb4aeb0d512.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:943160LDabQk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4207301455663295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsWBPG1RSXpH35qjsv:SbFuFyLVIg1BG+f+MsWlG+hEjZcHBrt
MD5:	B9E59918B3BC1FA1E36EF4D49D0758B5
SHA1:	8D2DFA0D1C1BC85EA1362598DBAB1C197C0C3984
SHA-256:	3E7FACED2C123E9214B3F96D73F7FEF8D7300D404B8DA095CB1D86A47AD5C492
SHA-512:	B9B67D3E191BBC6817EC6079F3D6DD2A384BFB04763F9732221906BDE963A9F6DCF813AC6F41A93B25961623B43E686DE325C664A116D5D1B908A1F0596C08F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f487d3a6cfb4480eb28e28e08a125908.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:943173uPkbwk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.532393506197841
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+My0hkhTjFQMzKaBu:qgFqo6g7/+0+f+MTkvTmh
MD5:	5145848D3ECAD4AAF5BE8B79D58440B2
SHA1:	5B50128CC9EE5C191029C0B8113EB5CCE8BBA144
SHA-256:	8179C5BC09E34AB5F2DDCB50F45D909E33333CF620691420CB06F44AB8E02B18
SHA-512:	FAF598484851CA13275484E8FB2F475854DEF1972FB13BEDBB8DDB4B5C9913D4ADC1C30CE6674216278713E7E765F47558814DA1B4B501FBA8FCDC2C9C3E44AB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b16262bc96641b48694870712f7a3a7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:9431754ZqO8j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.521044533006115
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mh3+2jFQMzKaBu:qgFqdg7/+0+f+MN+ETmh
MD5:	D7713753A6D07940E2C67F31C2A1EBC1
SHA1:	CA4953FB193DF51C19E10990977B1B7D5BF5BB19
SHA-256:	AB68D176384516D2A9D8511B338675DD99E57FF0B592CD95920EE80C6D79E71D
SHA-512:	54F313DF150C29CDCD4BAF898F41C403D1DDFE1D8B8AE747D14FEAC42659A8D16D15C366A51E06219B9CF5C35BA476B104B2FE17D79C8078C64AB280318EFE08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b4253286af74202968d1d6643edff69.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:976296Xuxk0j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.379504657269031
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+olUQRkgwbTRzATjx:SbFuFyLVIg1BG+f+M+mJeTRETjoa
MD5:	6FE3FE51AA91020B29326BCD28E6097D
SHA1:	85A660254DAFB7F59BD687BDE4B423E2F764DA32
SHA-256:	FBA258F146780824471C38DA4455A57B8071BB746CB7708689BFC3BD7EBC9659
SHA-512:	98DE0AAEA5D9E03E033F452699FF3EB1E1BF2609E55AE2CE76AF49463CE01EA90CEDF1CADF742581139C12DD33A8A493E8ACF30257B28CC9B1DE015613506C81
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41d8829b2e154dd1bea1754c4c7f844f.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:976334zUmUsl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.333663849676118
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6Ex+g7grxsjshQJWQ:SbFuFyLVIg1BG+f+M6i+8grqjtWL0
MD5:	E884DB3BB799BE46A97C21F9FB5D5737
SHA1:	C6AC2B9FFDDBE2F55CA249EB606DDBB0CC0A2D15
SHA-256:	9FCC58D728813504BCB951A572F53829BFAF330E94C0DAA75953AE0D111F8477
SHA-512:	A6C033B3AC6EF7077841501E438EAD53798F054A13E0591C272B377557E6EC57106D042ABCC62F89073F6BDA869C640DCF9AFF27920FB7161D86BD657E39FDA9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=07c0b9a7a1504fd185e8ea538afc932a.IDENTIFIER=pulseaudio.

/run/systemd/seats/.#seat00ViiCS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat05GfeoS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat06ha0xa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat09dFHUo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0VZ7Fh8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127DV66QR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.287984874878088
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffzgx23VdeQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBbgogthQHtPYq9M
MD5:	E1967B2EE0A259757B76991FDAE2DE84
SHA1:	26AF392CD1B09D1D6567E11483D51D6184C2E841
SHA-256:	A8B96D9FF5D522A9CF1F7604A6DA70FAA2761C0606804BB2BE0BA0A3F88F0213
SHA-512:	9426E6B510F6F33A4A5FCC520FF6530F1414B90F2B53BA798A78E6AC98E46776EBB46C88AC1A3756032FAA64AA7717C28962B5076236CEC2FF1ABB03ED7BE999
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13158.REALTIME=1735417753874065.MONOTONIC=558663001.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127EcSd4T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.328038523703598
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAA2354ydTa/L28H206qodu9yv:SbFuFyL3BVgdL87iesnAiRJgx23VdCtI
MD5:	3E894E55B1B3FB023158A02425B0F7F8
SHA1:	4A64DCC98FBE3A88E1BA98E33BD24806AC65EFAF
SHA-256:	FF5A2460E774A034F90B8517C1C886303F1062F167574C635307C03612A1D4B7
SHA-512:	08D80A830A4C183DA278343EEF46FFB11F0FD87D9D31EAFEB8498178B8876A2C387FED74961774ECF4E3045DAFA7C2060DDE7804B8DD702B4CFB9B8AAAAE5B16
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735417753874065.MONOTONIC=558663001.LAST_SESSION_TIMESTAMP=558729041.

/run/systemd/users/.#127U5GzB9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YPM0NR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.287984874878088
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffzgx23VdeQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBbgogthQHtPYq9M
MD5:	E1967B2EE0A259757B76991FDAE2DE84
SHA1:	26AF392CD1B09D1D6567E11483D51D6184C2E841
SHA-256:	A8B96D9FF5D522A9CF1F7604A6DA70FAA2761C0606804BB2BE0BA0A3F88F0213
SHA-512:	9426E6B510F6F33A4A5FCC520FF6530F1414B90F2B53BA798A78E6AC98E46776EBB46C88AC1A3756032FAA64AA7717C28962B5076236CEC2FF1ABB03ED7BE999
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13158.REALTIME=1735417753874065.MONOTONIC=558663001.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YwyFZP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482740681326379
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgx23VdCt6o9yv:qgFq30dABibB0TgoCIkyv
MD5:	55ECF850988659C42013B99E664FC530
SHA1:	552075E89CFEC833F40029FC0757046B009C601F
SHA-256:	DCE775C3BF349DDD0206FA767606C5710D23554EA7AD67D460F98B8307D90D87
SHA-512:	0BC881A4DCF8C3C0239AD34ADD95E8B8382C4BDD9D1A3F3C43BDCD9D01A6494713EC18B6AEF7B54E2ECB0BFE7FFFF5BDD04B61DA99F523D48CA034A75DA250CB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1735417753874065.MONOTONIC=558663001.LAST_SESSION_TIMESTAMP=558729041.

/run/systemd/users/.#127erY128

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.300378127196088
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAIyQRQmWjO206qodMWWR/:SbFuFyL3BVgdL87iesnAiRJgVNQIt6qh
MD5:	5615480F097D20B4620AB6D4F26B46C2
SHA1:	27DBA2A711550FE7DE5F815D447FEA72FC71EF1F
SHA-256:	31E4CBF548FAB7BC9140A6B1ED408A925DC344EDFB9923CADC4ACAF600E25B1E
SHA-512:	60674DBA6EC4E20B1A4E30E87B5C515B457861A4F4FBF23AE26F7AADFD1CA5635B6B865446AA03A2C214B9B1C6646AE18F211B3D36E0DE5D8F45FB7BAF2FE48F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735417674154508.MONOTONIC=478943444.LAST_SESSION_TIMESTAMP=479038142.

/run/systemd/users/.#127nFeQN7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295923991748753
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgVNQX2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgDthQHtPYq9M
MD5:	DFCD9F880B555723E3000FFBDB15344E
SHA1:	8841CCB2723FE3B4FFBD9D05EAF4B23C46D2D329
SHA-256:	DACBAD08A3EC11883BCBED0EDC8A009AA32E938A14C8348FA90732E9B5CB1E04
SHA-512:	ADA222FF246186E762F2646A16B2691005A741F19BAFF8A7BD870806C7D71E4780D55C35D08948AD1892870579F737D8F86140A05D042261A07D03C4357CE876
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735417674154508.MONOTONIC=478943444.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127qCD2L7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.461696926142252
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgVNQIt6qWW/:qgFq30dABibBAgDIqWW/
MD5:	017EA29B26F267367FF4D5D843571E40
SHA1:	D3ADE4E2A84FDD7EEFCCCAF55BD0F17949039638
SHA-256:	0E0307973512B6D143C12D452AB1B1FB53F8667BAE627F29F9590DEC4B8DC79E
SHA-512:	1FE0F60B98AFE0343A6DD8DAD0CB15A97A4082B0AC43C72138B9706A440FB56D92444ABDD7BF63EE5C8C859B86FE9A0F667C60E31FBCABFA84E537EACFBB0563
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1735417674154508.MONOTONIC=478943444.LAST_SESSION_TIMESTAMP=479038142.

/run/systemd/users/.#127x2a18P

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xn3XAR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482740681326379
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgx23VdCt6o9yv:qgFq30dABibB0TgoCIkyv
MD5:	55ECF850988659C42013B99E664FC530
SHA1:	552075E89CFEC833F40029FC0757046B009C601F
SHA-256:	DCE775C3BF349DDD0206FA767606C5710D23554EA7AD67D460F98B8307D90D87
SHA-512:	0BC881A4DCF8C3C0239AD34ADD95E8B8382C4BDD9D1A3F3C43BDCD9D01A6494713EC18B6AEF7B54E2ECB0BFE7FFFF5BDD04B61DA99F523D48CA034A75DA250CB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1735417753874065.MONOTONIC=558663001.LAST_SESSION_TIMESTAMP=558729041.

/run/systemd/users/.#127yeiTB8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295923991748753
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgVNQX2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgDthQHtPYq9M
MD5:	DFCD9F880B555723E3000FFBDB15344E
SHA1:	8841CCB2723FE3B4FFBD9D05EAF4B23C46D2D329
SHA-256:	DACBAD08A3EC11883BCBED0EDC8A009AA32E938A14C8348FA90732E9B5CB1E04
SHA-512:	ADA222FF246186E762F2646A16B2691005A741F19BAFF8A7BD870806C7D71E4780D55C35D08948AD1892870579F737D8F86140A05D042261A07D03C4357CE876
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735417674154508.MONOTONIC=478943444.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Kcv:Kcv
MD5:	68EF0598F13BAD2AC7A32AE0B5C4B6A1
SHA1:	FE53A353386CB02E27C58A69C4DAE8B8B932259D
SHA-256:	F0A72E5AA5418A681AD1DD1BC4A938CFF8332AFEA835FDD77F72C5AEE22E62C5
SHA-512:	76CA71CD3FCFB8053B40F307B92EF519B0A645A4798B9CCC03E73F53E9681C1B64CDA65B41E16FDDC553614467F47982B48784F42B0879AE02DBDEF4F501DC2F
Malicious:	false
Preview:	6709.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Idvn:Itn
MD5:	2A11D2A686DEE108F06EC9310B488913
SHA1:	C9B784753CA124F6FB8F24660CC06C1EA483E2B4
SHA-256:	0B1DBDB46AD59611C76C15FA61BE9421BF56D3009545629E384FAFDDF05A8FCB
SHA-512:	1EF556AD5EE20E9BBEEFC737B1571819D0F1D19FED48C9B2101EE89EDDB6A73E7FE8E48C4547F904DEBD58922CFB9B1EBE7698FFF19BEAF1AFB4F63721943A89
Malicious:	false
Preview:	6728.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422345
Encrypted:	false
SSDEEP:	3:bCsXlXEWtl/nF4:bf+ylvW
MD5:	30E16F99EC8A89D48305E819FBA1674F
SHA1:	C526EE8A729420DF2B426ACB891C8F8DE4938376
SHA-256:	176034C40F4504A16671FBBC601AB6055C69A75B1E6AB5600F0933B8EF126ACE
SHA-512:	5C1FFB740AEF7A8B9AC4A70EC814CB5EEE004CF1C7F204C55D2CF780C8AB2FDCE4B568054F2D4E5D57CCFD9B4253117130A4573E36819F4F872068608C840B7E
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................._pgt.......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ISvn:ISv
MD5:	C415FA91DF770FB523F29564980ECE04
SHA1:	6F16182F6DE5CC0BB6BCA54B8482BDDB4A713CCD
SHA-256:	E83A363CA497FD5C82AB66E0A23300F4C4104E6FA182CD08D833DC00F258990F
SHA-512:	2BA19A43CFA3D3F43B037D11338FE24F5D71A87FE61561958073412DFB81C0D905A1EFA33E9E95B3CEB41BB00F2D740F0D65CC756F7F3D23BD8F63EDFEFC895A
Malicious:	false
Preview:	6727.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:KXLhvn:KFv
MD5:	361B9AB4FD277218C81332A49BDF1A2A
SHA1:	3D35F2655006836E8B46EBEF4266E16B86A53492
SHA-256:	FB5ADE086057A5F8C712C45E07048480D0DCAC3D7E1A9B553FE1D339ECC88B47
SHA-512:	ED11FCC911222917BE7D1F9DF884991CF76A10D5BEB62C7FD7561FFEE01691D0EAD0C5A969BCE37106257380BD03CFB85C99785F39545534D4922FF43B2D0061
Malicious:	false
Preview:	6702.6703.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Idvn:Itn
MD5:	2A11D2A686DEE108F06EC9310B488913
SHA1:	C9B784753CA124F6FB8F24660CC06C1EA483E2B4
SHA-256:	0B1DBDB46AD59611C76C15FA61BE9421BF56D3009545629E384FAFDDF05A8FCB
SHA-512:	1EF556AD5EE20E9BBEEFC737B1571819D0F1D19FED48C9B2101EE89EDDB6A73E7FE8E48C4547F904DEBD58922CFB9B1EBE7698FFF19BEAF1AFB4F63721943A89
Malicious:	false
Preview:	6728.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ISvn:ISv
MD5:	C415FA91DF770FB523F29564980ECE04
SHA1:	6F16182F6DE5CC0BB6BCA54B8482BDDB4A713CCD
SHA-256:	E83A363CA497FD5C82AB66E0A23300F4C4104E6FA182CD08D833DC00F258990F
SHA-512:	2BA19A43CFA3D3F43B037D11338FE24F5D71A87FE61561958073412DFB81C0D905A1EFA33E9E95B3CEB41BB00F2D740F0D65CC756F7F3D23BD8F63EDFEFC895A
Malicious:	false
Preview:	6727.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:KXLhvn:KFv
MD5:	361B9AB4FD277218C81332A49BDF1A2A
SHA1:	3D35F2655006836E8B46EBEF4266E16B86A53492
SHA-256:	FB5ADE086057A5F8C712C45E07048480D0DCAC3D7E1A9B553FE1D339ECC88B47
SHA-512:	ED11FCC911222917BE7D1F9DF884991CF76A10D5BEB62C7FD7561FFEE01691D0EAD0C5A969BCE37106257380BD03CFB85C99785F39545534D4922FF43B2D0061
Malicious:	false
Preview:	6702.6703.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Idvn:Itn
MD5:	2A11D2A686DEE108F06EC9310B488913
SHA1:	C9B784753CA124F6FB8F24660CC06C1EA483E2B4
SHA-256:	0B1DBDB46AD59611C76C15FA61BE9421BF56D3009545629E384FAFDDF05A8FCB
SHA-512:	1EF556AD5EE20E9BBEEFC737B1571819D0F1D19FED48C9B2101EE89EDDB6A73E7FE8E48C4547F904DEBD58922CFB9B1EBE7698FFF19BEAF1AFB4F63721943A89
Malicious:	false
Preview:	6728.

/tmp/qemu-open.iscuyL (deleted)

Download File

Process:	/tmp/fnkea7.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.056020968057881
Encrypted:	false
SSDEEP:	3:TgA78HJN:TgAKJN
MD5:	DDA8A2C2CDBED8242E6613F9F91554AD
SHA1:	B2173D9FBA6CE0674B1BB8C895DFFCD31F046BBC
SHA-256:	5F294B98DEF330F44076FC4698C77B36A72A1F12859E29DE92098CE92361A6CE
SHA-512:	2BFFB04D993D23ECEF225B6AAA9BB7DC3E7A10754ECBF497932C06E0DA7C9A1C95E1617FE01E0685242E4AC9B46EC2BB47AC0F5B20A7F3AE5DDB3A692B336ADC
Malicious:	false
Preview:	/tmp/fnkea7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.IIUUZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.Y3UZZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.922750417829579
Encrypted:	false
SSDEEP:	24:RFZea1rG1PsPlcnyAAvNAA2+VPgl0pYrKJr/xurCQU:RfiEtcylvNlfVP9YrMr0rCn
MD5:	34EB466271311F806073A54390462DB0
SHA1:	98B343A7FD90CBED4F5B970B39C43CE07B40DA73
SHA-256:	302A2E76D586509977B9A7B4804505A5F2CDAD98918D68B85AEC50C30660EB6A
SHA-512:	8D24836ABDBB97E569C79A7043FF7AFC0B5EA64419AEA92699828A3D2A6A66EBB7667AF587600055D639940C2AB73C33A20FBDC6A5F57E9B477ECB59C0EAA2F6
Malicious:	false
Preview:	Dec 28 14:29:08 galassia systemd-logind[6608]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 14:29:08 galassia systemd-logind[6608]: User enumeration failed: Invalid argument.Dec 28 14:29:08 galassia systemd-logind[6608]: User of session c2 not known..Dec 28 14:29:08 galassia systemd-logind[6608]: User of session 2 not known..Dec 28 14:29:08 galassia systemd-logind[6608]: Session enumeration failed: No such file or directory.Dec 28 14:29:08 galassia systemd-logind[6608]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 14:29:08 galassia systemd-logind[6608]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 14:29:08 galassia systemd-logind[6608]: New seat seat0..Dec 28 14:29:13 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 14:29:14 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 14:29:14

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hl/gww3XtgwwHXl:F3twPw
MD5:	A6D98861BFC3B4C99F65DAA9F58C4BF6
SHA1:	DA08498FF3A5FA1530612DDA72E2B0F147508978
SHA-256:	42D84C27EC9C7FF78DD3759707108ECC4CAA74840B152D5AEE9191FCA0DF98DC
SHA-512:	5C8F3B5CADC72EAB7149D654F03BFEE716243F47B816D2DEBF9DDAF3C0484CF974D6FCE03CEBDBABB10FC8657D016E6ADC8CC839DEA2067F1D37D2F4B2283B75
Malicious:	false
Preview:	LPKSHHRH.................(....FT......Yv.................................(....FT......Yv........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlYl3hpSBQ7XlKl3hpSBQ7nl:F3oth8BQrlKth8BQ7l
MD5:	D05407822B682567B155345EDC85D331
SHA1:	28107E6280E47E6BDB707C61437976D9F6BDACC7
SHA-256:	F53B36BD9CD4F45E9EF403DD7348C60F77A69F900BE29D5773F1DD3651DA775D
SHA-512:	C42E910622D1B7BD13571765C53459857B431E12950C7538E14673D19E82389355B3A010CEF5F20135EEA41D8A057D63C0B669A82DB89DBF3554712312705507
Malicious:	false
Preview:	LPKSHHRH................j...@RN..$5....................................j...@RN..$5............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9753
Entropy (8bit):	4.995491287408577
Encrypted:	false
SSDEEP:	192:87ts1j8YJVbNFSQoTr8SNs3M1deXGpFjbR5r8mpOUI:01YJVb3oHTsc1de23j2
MD5:	0C8F3E759A78077D9822F37AF2728BDA
SHA1:	F94B0F3201847242BDFBF588382ECA9305B33E5C
SHA-256:	D174F56CC7FA1C5CB094007BA9C3462619F204388D75AEB22FE45502060C154A
SHA-512:	36A146D826ED20329BCB6575D6823B0E0C0FABB016359875B2F8F919E6861F02291DA2E0B409A556893529330F5756F5D528A17CEF12E6B0205AF5AA3BD5C743
Malicious:	false
Preview:	Dec 28 14:29:05 galassia kernel: [ 550.472010] New task spawned: old: (tgid 6665, tid 6665), new (tgid: 6665, tid: 6668).Dec 28 14:29:05 galassia kernel: [ 550.472513] New task spawned: old: (tgid 6665, tid 6665), new (tgid: 6665, tid: 6669).Dec 28 14:29:06 galassia kernel: [ 550.480894] New task spawned: old: (tgid 6665, tid 6669), new (tgid: 6665, tid: 6670).Dec 28 14:29:06 galassia kernel: [ 550.613092] New task spawned: old: (tgid 6666, tid 6666), new (tgid: 6666, tid: 6671).Dec 28 14:29:06 galassia kernel: [ 550.817746] New task spawned: old: (tgid 6666, tid 6666), new (tgid: 6666, tid: 6672).Dec 28 14:29:06 galassia kernel: [ 550.888228] New task spawned: old: (tgid 6666, tid 6666), new (tgid: 6666, tid: 6673).Dec 28 14:29:08 galassia kernel: [ 550.960165] New task spawned: old: (tgid 6666, tid 6666), new (tgid: 6666, tid: 6674).Dec 28 14:29:09 galassia kernel: [ 552.970932] New task spawned: old: (tgid 6667, tid 6667), new (tgid: 6667, tid: 6676).Dec 28 14:29:09 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	28890
Entropy (8bit):	5.122781891001138
Encrypted:	false
SSDEEP:	768:HG9a+sjPDnp9RJ+7gYJNjZFlqOMpR1XLdx/wGKEAMYqVXjRR/rdqEQGr:mm/RmRFE
MD5:	187C2C6903E0E8DCC768676F5676BFCF
SHA1:	DF8A069652A16669B59CD99748F5C43251FA43A5
SHA-256:	99766CBDA0F385A03E03891FFA127A7BA295795D2D270EA4334DCCA5DC19F8E0
SHA-512:	30040EEDDBDF0701094E3C3CF00CBF6FA799E8558383B87D3EE93DAE14DF506753A2EFC5D67AD5CB30CB8004675A9359CF107B57A7CBA0E7ADEF13E7A467A2C2
Malicious:	false
Preview:	Dec 28 14:29:05 galassia kernel: [ 549.058419] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 28 14:29:05 galassia kernel: [ 549.058491] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 28 14:29:05 galassia kernel: [ 549.061241] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 28 14:29:05 galassia kernel: [ 549.061247] systemd[1]: dbus.service: Failed with result 'signal'..Dec 28 14:29:05 galassia kernel: [ 549.062816] systemd[1]: Started D-Bus System Message Bus..Dec 28 14:29:05 galassia kernel: [ 549.069569] systemd[1]: getty@tty2.service: Succeeded..Dec 28 14:29:05 galassia kernel: [ 549.070215] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 2..Dec 28 14:29:05 galassia kernel: [ 549.070227] systemd[1]: Stopped Getty on tty2..Dec 28 14:29:05 galassia kernel: [ 549.070802] systemd[1]: Started Getty on tty2..Dec 28 14:29:05 galassia kernel: [ 549.071141] systemd[1]: whoop

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6667178117422345
Encrypted:	false
SSDEEP:	3:bCsXlXEWtl/nF4:bf+ylvW
MD5:	30E16F99EC8A89D48305E819FBA1674F
SHA1:	C526EE8A729420DF2B426ACB891C8F8DE4938376
SHA-256:	176034C40F4504A16671FBBC601AB6055C69A75B1E6AB5600F0933B8EF126ACE
SHA-512:	5C1FFB740AEF7A8B9AC4A70EC814CB5EEE004CF1C7F204C55D2CF780C8AB2FDCE4B568054F2D4E5D57CCFD9B4253117130A4573E36819F4F872068608C840B7E
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................._pgt.......................................

Source: fnkea7.elf	ReversingLabs: Detection: 43%
Source: fnkea7.elf	Virustotal: Detection: 39%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:53456 -> 178.215.238.153:33966
Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.978024631638187
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fnkea7.elf
File size:	216'918 bytes
MD5:	6ecc74633b970952196f941f10be5b0d
SHA1:	b405c075017f53204ec6d924c36d555a9674a370
SHA256:	152ba31ed8ed6767562adbf031039b446c9984733ccc13e9a7b2785399587f73
SHA512:	bd814ed499df278d437da866af4783d49f2804345e2fea598d26741972fb43c1cc1e7ac6a16888a7114ffd98432f223f09ef412cf260cd245f3e4fc8d9dbf1af
SSDEEP:	6144:FLziNEEQ/E8OFR3h0sEiaUVB1ILe6uuQdtEwvSw0M/RvhFY:F6NHMTc39EiaaB1ILXPgEdwJ/vC
TLSH:	BE241A45AA418F13C4D727BAF69F42453333A754D3EB73069928AFB43B8679E4F22601
File Content Preview:	.ELF..............(.........4...,.......4. ...(........p............x...x................................................................U..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	171052
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1de58	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x25f48	0x1df48	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25f58	0x1df58	0x2a14	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2896c	0x2096c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x28984	0x20984	0x178	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x31000	0x21000	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x31004	0x21004	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x31008	0x21008	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x31008	0x21008	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x3100c	0x2100c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x31010	0x21010	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x31014	0x21014	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x310d4	0x210d4	0x2f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x313c4	0x213c4	0x5234	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x213c4	0x1054	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x22418	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x22598	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x227d6	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x2527d	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25c17	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x26da4	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x270e0	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x27b9c	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x293c6	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x29af6	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x29b0c	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a0dc	0x7130	0x10	0x0		29	1061	4
.strtab	STRTAB	0x0	0x3120c	0x3d4a	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x20984	0x28984	0x28984	0x178	0x178	4.6653	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20afc	0x20afc	6.1162	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x21000	0x31000	0x31000	0x3c4	0x55f8	4.7007	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x21004	0x31004	0x31004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 21:27:40.304363966 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 21:29:00.314115047 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 21:26:50.981436968 CET	8.8.8.8	192.168.2.23	0xdbb6	No error (0)	raw.cardiacpure.ru	178.215.238.153	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:27:37.685811996 CET	1.1.1.1	192.168.2.23	0x9c71	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:27:37.685811996 CET	1.1.1.1	192.168.2.23	0x9c71	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:28:54.035007000 CET	1.1.1.1	192.168.2.23	0x3390	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:28:54.035007000 CET	1.1.1.1	192.168.2.23	0x3390	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-28 20:27:42 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 20:27:43 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 20:27:43 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 20:27:44 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 20:27:44 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:26:49
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	/tmp/fnkea7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:26:50
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:27:58
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:28:54
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:27:29
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:30
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:34
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:35
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:36
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:27:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fnkea7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6467/oom_score_adj

/proc/6715/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1090249V3lIyl

/run/systemd/journal/streams/.#9:1287710a7pp0i

/run/systemd/journal/streams/.#9:1287758tzeMzm

/run/systemd/journal/streams/.#9:581091YvO57h

/run/systemd/journal/streams/.#9:581177hGwL5l

/run/systemd/journal/streams/.#9:581285emTutm

/run/systemd/journal/streams/.#9:581333vEk9Xl

/run/systemd/journal/streams/.#9:581335Ra1NTl

/run/systemd/journal/streams/.#9:759600M0ccs

/run/systemd/journal/streams/.#9:75961x7bERr

/run/systemd/journal/streams/.#9:760968PEvwr

/run/systemd/journal/streams/.#9:76152d3z0go

/run/systemd/journal/streams/.#9:76159Cs9Brs

/run/systemd/journal/streams/.#9:76356ZhhYcp

/run/systemd/journal/streams/.#9:76357NFn7qq

/run/systemd/journal/streams/.#9:76373fXWF6p

/run/systemd/journal/streams/.#9:76639TBm7ip

/run/systemd/journal/streams/.#9:76737MHf4Qp

Linux Analysis Report
fnkea7.elf

Start time (UTC):	20:27:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:27:42
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:40
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Start time (UTC):	20:27:44
Start date (UTC):	28/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	20:27:52
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:53
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:27:54
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:27:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	20:28:50
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75