Edit tour

Linux Analysis Report
fnkea7.elf

Overview

General Information

Sample name:	fnkea7.elf
Analysis ID:	1581740
MD5:	fe01e8fc0efa451ac06c7f5dd81bae4e
SHA1:	acdeffd6f7f0ed3557c9b233749d6dd91abac905
SHA256:	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581740
Start date and time:	2024-12-28 21:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fnkea7.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/118@147/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/fnkea7.elf
PID:	6241
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

fnkea7.elf (PID: 6241, Parent: 6156, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/fnkea7.elf

fnkea7.elf New Fork (PID: 6243, Parent: 6241)

fnkea7.elf New Fork (PID: 6245, Parent: 6243)

fnkea7.elf New Fork (PID: 6247, Parent: 6245)

sh (PID: 6247, Parent: 6245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6253, Parent: 6247)

ps (PID: 6253, Parent: 6247, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6485, Parent: 6245)

sh (PID: 6485, Parent: 6245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6489, Parent: 6485)

ps (PID: 6489, Parent: 6485, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

fnkea7.elf New Fork (PID: 6594, Parent: 6245)

sh (PID: 6594, Parent: 6245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6597, Parent: 6594)

ps (PID: 6597, Parent: 6594, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

systemd New Fork (PID: 6291, Parent: 1)

journalctl (PID: 6291, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6312, Parent: 1)

systemd-journald (PID: 6312, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6313, Parent: 1)

journalctl (PID: 6313, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6319, Parent: 1)

dbus-daemon (PID: 6319, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6330, Parent: 1860)

pulseaudio (PID: 6330, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6332, Parent: 1)

rsyslogd (PID: 6332, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6334, Parent: 1)

rtkit-daemon (PID: 6334, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6337, Parent: 1)

systemd-logind (PID: 6337, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6402, Parent: 1)

polkitd (PID: 6402, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6408, Parent: 1)

agetty (PID: 6408, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6409, Parent: 1320)

Default (PID: 6409, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6410, Parent: 1320)

Default (PID: 6410, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6411, Parent: 1320)

Default (PID: 6411, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6414, Parent: 1)

gpu-manager (PID: 6414, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6415, Parent: 6414)

sh (PID: 6415, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6416, Parent: 6415)

grep (PID: 6416, Parent: 6415, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6417, Parent: 6414)

sh (PID: 6417, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6414)

sh (PID: 6420, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6422, Parent: 6414)

sh (PID: 6422, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6423, Parent: 6422)

grep (PID: 6423, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6425, Parent: 6414)

sh (PID: 6425, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6427, Parent: 6414)

sh (PID: 6427, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6429, Parent: 6414)

sh (PID: 6429, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6430, Parent: 6429)

grep (PID: 6430, Parent: 6429, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6431, Parent: 6414)

sh (PID: 6431, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6433, Parent: 1)

generate-config (PID: 6433, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6434, Parent: 6433)

pkill (PID: 6434, Parent: 6433, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6435, Parent: 1)

gdm-wait-for-drm (PID: 6435, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 6439, Parent: 2038)

fusermount (PID: 6439, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6445, Parent: 1)

gdm3 (PID: 6445, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6449, Parent: 6445)

plymouth (PID: 6449, Parent: 6445, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6469, Parent: 6445)

gdm-session-worker (PID: 6469, Parent: 6445, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6473, Parent: 6469)

gdm-wayland-session (PID: 6473, Parent: 6469, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6475, Parent: 6473)

dbus-daemon (PID: 6475, Parent: 6473, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6477, Parent: 6475)

dbus-daemon New Fork (PID: 6478, Parent: 6477)

false (PID: 6478, Parent: 6477, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6479, Parent: 6473)

dbus-run-session (PID: 6479, Parent: 6473, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6480, Parent: 6479)

dbus-daemon (PID: 6480, Parent: 6479, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6481, Parent: 6445)

Default (PID: 6481, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6482, Parent: 6445)

Default (PID: 6482, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6451, Parent: 1)

accounts-daemon (PID: 6451, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6462, Parent: 6451)

language-validate (PID: 6462, Parent: 6451, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6463, Parent: 6462)

language-options (PID: 6463, Parent: 6462, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6466, Parent: 6463)

sh (PID: 6466, Parent: 6463, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6467, Parent: 6466)

locale (PID: 6467, Parent: 6466, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6468, Parent: 6466)

grep (PID: 6468, Parent: 6466, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6514, Parent: 1)

journalctl (PID: 6514, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6515, Parent: 1)

systemd-journald (PID: 6515, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6516, Parent: 1)

dbus-daemon (PID: 6516, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6519, Parent: 1)

rsyslogd (PID: 6519, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6522, Parent: 1)

systemd-logind (PID: 6522, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6583, Parent: 1)

agetty (PID: 6583, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6586, Parent: 1)

gpu-manager (PID: 6586, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6587, Parent: 6586)

sh (PID: 6587, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6588, Parent: 6587)

grep (PID: 6588, Parent: 6587, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6589, Parent: 6586)

sh (PID: 6589, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6590, Parent: 6589)

grep (PID: 6590, Parent: 6589, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6591, Parent: 6586)

sh (PID: 6591, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6592, Parent: 6591)

grep (PID: 6592, Parent: 6591, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6593, Parent: 6586)

sh (PID: 6593, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6593)

grep (PID: 6596, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6598, Parent: 6586)

sh (PID: 6598, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6599, Parent: 6598)

grep (PID: 6599, Parent: 6598, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6600, Parent: 6586)

sh (PID: 6600, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6601, Parent: 6600)

grep (PID: 6601, Parent: 6600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6604, Parent: 6586)

sh (PID: 6604, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6605, Parent: 6604)

grep (PID: 6605, Parent: 6604, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6606, Parent: 6586)

sh (PID: 6606, Parent: 6586, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6607, Parent: 6606)

grep (PID: 6607, Parent: 6606, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6608, Parent: 1)

generate-config (PID: 6608, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6609, Parent: 6608)

pkill (PID: 6609, Parent: 6608, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6610, Parent: 1)

journalctl (PID: 6610, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6612, Parent: 1)

gdm-wait-for-drm (PID: 6612, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6615, Parent: 1)

journalctl (PID: 6615, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6616, Parent: 1)

dbus-daemon (PID: 6616, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6617, Parent: 1)

agetty (PID: 6617, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6620, Parent: 1)

systemd-logind (PID: 6620, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6673, Parent: 1)

rsyslogd (PID: 6673, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6679, Parent: 1)

systemd-journald (PID: 6679, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6689, Parent: 1)

journalctl (PID: 6689, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6691, Parent: 1)

gdm3 (PID: 6691, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6694, Parent: 6691)

plymouth (PID: 6694, Parent: 6691, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6710, Parent: 6691)

gdm-session-worker (PID: 6710, Parent: 6691, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6722, Parent: 6710)

gdm-wayland-session (PID: 6722, Parent: 6710, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6724, Parent: 6722)

dbus-daemon (PID: 6724, Parent: 6722, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6728, Parent: 6724)

dbus-daemon New Fork (PID: 6729, Parent: 6728)

false (PID: 6729, Parent: 6728, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6730, Parent: 6722)

dbus-run-session (PID: 6730, Parent: 6722, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6733, Parent: 6730)

dbus-daemon (PID: 6733, Parent: 6730, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6736, Parent: 6691)

Default (PID: 6736, Parent: 6691, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6738, Parent: 6691)

Default (PID: 6738, Parent: 6691, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6695, Parent: 1)

accounts-daemon (PID: 6695, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6699, Parent: 6695)

language-validate (PID: 6699, Parent: 6695, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6700, Parent: 6699)

language-options (PID: 6700, Parent: 6699, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6701, Parent: 6700)

sh (PID: 6701, Parent: 6700, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6702, Parent: 6701)

locale (PID: 6702, Parent: 6701, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6703, Parent: 6701)

grep (PID: 6703, Parent: 6701, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6706, Parent: 1)

polkitd (PID: 6706, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6715, Parent: 1860)

dbus-daemon (PID: 6715, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6716, Parent: 1860)

pulseaudio (PID: 6716, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6717, Parent: 1)

rtkit-daemon (PID: 6717, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6720, Parent: 1)

systemd (PID: 6720, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6725, Parent: 6720)

systemd New Fork (PID: 6726, Parent: 6725)

30-systemd-environment-d-generator (PID: 6726, Parent: 6725, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6739, Parent: 6720)

systemctl (PID: 6739, Parent: 6720, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6740, Parent: 6720)

pulseaudio (PID: 6740, Parent: 6720, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6745, Parent: 6720)

dbus-daemon (PID: 6745, Parent: 6720, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fnkea7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
fnkea7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6241.1.00007f712c017000.00007f712c038000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6241.1.00007f712c017000.00007f712c038000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: fnkea7.elf PID: 6241	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: fnkea7.elf PID: 6241	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11a9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ac2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ad6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11afe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6332)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6519)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6673)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6312)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6445)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6475)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6679)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6691)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6724)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6720)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.193.dr, syslog.32.dr, syslog.137.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38352
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007f712c017000.00007f712c038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fnkea7.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4485, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4510, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6055, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6312, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6329, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6337, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6402, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6445, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6451, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6485, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6515, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6516, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6522, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6597, result: no such process	Jump to behavior

Source: fnkea7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/maps[killer/maps] killed process: %s ;; pid: %d

Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4485, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 4510, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6055, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6213, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6312, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6329, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6334, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6337, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6402, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6445, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6451, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6485, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6489, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6515, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6516, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6522, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6594, result: no such process	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6245)	SIGKILL sent: pid: 6597, result: no such process	Jump to behavior

Source: fnkea7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007f712c017000.00007f712c038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fnkea7.elf PID: 6241, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/118@147/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6319)	File: /proc/6319/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6439)	File: /proc/6439/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6475)	File: /proc/6475/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6480)	File: /proc/6480/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6516)	File: /proc/6516/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6616)	File: /proc/6616/mounts
Source: /usr/bin/dbus-daemon (PID: 6724)	File: /proc/6724/mounts
Source: /usr/bin/dbus-daemon (PID: 6733)	File: /proc/6733/mounts
Source: /usr/bin/dbus-daemon (PID: 6715)	File: /proc/6715/mounts
Source: /usr/bin/dbus-daemon (PID: 6745)	File: /proc/6745/mounts

Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:75614wE2q2r	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:75615K1VhLr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:761059ixoXu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:76115h7C4ew	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:76117Jo0Evs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:76131otxl5t	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:76132WlfvTu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77259ry5BAu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77263rKzXos	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77284ZJyMYt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77308IKeG7s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77382dqJ6Hv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77434IoGpus	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:77530MOuxiw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78118OoBq4t	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78147Gp18au	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78204Ks7F6s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78206SLEqzt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78256guvJ4v	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	File: /run/systemd/journal/streams/.#9:78259o47H0r	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/seats/.#seat0edMjgn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127c0NWUm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127wc5NVn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/seats/.#seat06Cknin	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127I0EjFm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127ZYYlyo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127l3Q7mp	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6402)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6473)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79290ZR8dwR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79293OeP8CP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79320K4KGRQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:793218sEJjP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79330Ijah5P	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79331iwkslP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79332YkGOTR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	File: /run/systemd/journal/streams/.#9:79349T42tBO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6522)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6522)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6522)	File: /run/systemd/seats/.#seat0OoC0hn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6620)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6620)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/seats/.#seat0OAqRGL
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127o7P8xK
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127riTPAM
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/seats/.#seat04RBZGM
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127AFx0BN
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127BtTm0K
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127e2nInM
Source: /lib/systemd/systemd-logind (PID: 6620)	File: /run/systemd/users/.#127D2JWVK
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1068486dxa5d
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:106849Gl3owe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:106857KuoiJe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:106866RsdAYf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:106867UqHFGf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:106943tAG4Ef
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:107022aNcSOf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:107124vZUXUc
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:107232tYBEng
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:107280q8pKAc
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:107282IuXMbe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1006571Bybukg
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026066GTTFxe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026203J6cKxf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:10263535VP5id
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026372e0qGzc
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026376uKag7e
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026583x2v5Wf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026631dqHulf
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:1026773u0aove
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6722)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6695)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6695)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6706)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6720)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6726)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1582/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1582/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1579/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1579/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1698/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1698/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1576/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1576/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/910/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/912/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2307/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/918/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/ps (PID: 6253)	File opened: /proc/13/cmdline	Jump to behavior

Source: /tmp/fnkea7.elf (PID: 6247)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6485)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/fnkea7.elf (PID: 6594)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6429)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6466)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6587)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6589)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6591)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6598)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6600)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6604)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6606)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6701)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6416)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6423)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6468)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6588)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6590)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6592)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6605)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6607)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6703)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6434)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6609)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6253)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6489)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6597)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior

Source: /lib/systemd/systemd (PID: 6739)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6253)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6489)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6597)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6679)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6408)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6583)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6617)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6445)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6445)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6691)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6691)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6695)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6695)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6332)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6332)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6414)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6519)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6519)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6586)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6673)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6673)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fnkea7.elf (PID: 6243)

File: /tmp/fnkea7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6414)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Source: /usr/bin/ps (PID: 6253)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6489)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6597)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6330)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6434)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6609)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6740)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/fnkea7.elf (PID: 6241)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6312)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6330)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6332)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6414)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6469)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6515)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6519)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6583)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6617)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6673)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6679)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6710)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6716)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6740)	Queries kernel information via 'uname':

Source: kern.log.193.dr	Binary or memory string: Dec 28 14:44:20 galassia kernel: [ 562.950810] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: fnkea7.elf, 6241.1.00007ffc60e06000.00007ffc60e27000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.tg0S47
Source: fnkea7.elf, 6241.1.000055ee0365e000.000055ee037b0000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: fnkea7.elf, 6241.1.00007ffc60e06000.00007ffc60e27000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.tg0S47:
Source: kern.log.193.dr	Binary or memory string: Dec 28 14:44:20 galassia kernel: [ 562.950837] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.32.dr	Binary or memory string: Dec 28 14:42:58 galassia kernel: [ 480.617555] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: fnkea7.elf, 6241.1.000055ee0365e000.000055ee037b0000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: fnkea7.elf, 6241.1.00007ffc60e06000.00007ffc60e27000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: fnkea7.elf, 6241.1.00007ffc60e06000.00007ffc60e27000.rw-.sdmp	Binary or memory string: Igx86_64/usr/bin/qemu-arm/tmp/fnkea7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fnkea7.elf
Source: syslog.32.dr	Binary or memory string: Dec 28 14:42:58 galassia kernel: [ 480.617617] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6451)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6695)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6241.1.00007f712c017000.00007f712c038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fnkea7.elf PID: 6241, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: fnkea7.elf, type: SAMPLE
Source: Yara match	File source: 6241.1.00007f712c017000.00007f712c038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fnkea7.elf PID: 6241, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fnkea7.elf	43%	ReversingLabs	Linux.Backdoor.Mirai
fnkea7.elf	39%	Virustotal		Browse
fnkea7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.153	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.193.dr, syslog.32.dr, syslog.137.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	fnkea7.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	fnkea7.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	fnkea7.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	fnkea7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	dlr.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	wkb86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	fnkea7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
raw.cardiacpure.ru	kqibeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	fnkea7.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	kqibeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wkb86.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	fnkea7.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
CANONICAL-ASGB	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	fnkea7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dlr.mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	wkb86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fnkea7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	nshkarm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6478/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6729/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:tv:d
MD5:	5EEBE1A2DF5290E68935718FF9B089AE
SHA1:	090EBFEF4D01CAEB42BD0F5D6CD673FAE336E7D3
SHA-256:	E0D757BC44E2F8C71716A577CCE7715B6E2456FB93296A36E5B4E00E6002F10C
SHA-512:	40D515BFA257B18200A2833B29A4FFB628EF1151D8EC9A2A45835AD063F32F43EE8DAD90794812B8D39A21FAC44BF59E1570722E191D938FAA821C895379C863
Malicious:	false
Preview:	6691.

/run/systemd/journal/streams/.#9:1006571Bybukg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3583406361050105
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6eEUW4BfGEW+DQGNC:SbFuFyLVIg1BG+f+M64WnEhHN2joa
MD5:	83D549E519BE9C9A34F3B9E5810E35EE
SHA1:	7805F44E6F15F5F3D20BF74A845CEDB7A53F96A2
SHA-256:	8FDD5F50AEC372C42A588CEE74FCEE4A1BE5B6A3B45B4A7449750920E43C52D9
SHA-512:	281BF4DACDE7B03DEC8A074DD219B4FE39D06CC09EE27729CB8B426C212459E1B2794181D6A3E72A72777AB6D5B529C00097EAF16228B0005FF1A0B0483518E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02a587da5d3a4d7492bbca81420afcbc.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:1026066GTTFxe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.348180104746334
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzpC21X5kUHTGFrxsh:SbFuFyLVIg1BG+f+Mo21Jdz6rqjtWL0
MD5:	16B8185048A1F88C0A3913E41A7C43C7
SHA1:	BFA0A45B51B2F0F963AE2ADA8AEF7C625BAE0629
SHA-256:	EFACE45A8EC5652CE03657C7B855765A56C351391507585DC04B52F0E7E5BD18
SHA-512:	591D77A9BCEE5B9A9C56F964E7CE3079262E61C37569B854857CC066C9E766ED716B9378CFD96C355AD704F4F287C2E8C93D99CBA6FC9EE6D5DEB0ACF605C8D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d51a0a2f04b490993b0213dd71b5c8c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:1026203J6cKxf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.422453992727927
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz5BGHmWPYUftHev8O:SbFuFyLVIg1BG+f+M1BGHhY8jNE
MD5:	6B06E8A0E027EC7AD767B5A1697AACBB
SHA1:	92B77D887B9A80F8C14313C21718BA0BB574CEF2
SHA-256:	06B12C23F7F7074BF856D64627981F931AB94FC7ED114F3B4B7C361D71915C78
SHA-512:	AB9FAD8317C4A040428358DF1C2741C24DA5EB4187C2683DBE9CD0A047B7CF2C92DFFB0B6935A706748727EAD8124CF7609B6DB46D7AF1C52DC81CC52D2B4280
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b60d24561ab4e33a6d3818899b5608d.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:10263535VP5id

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.422210853230373
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvwRcQ40qpf10wsjsv:SbFuFyLVIg1BG+f+M4Rcnt0jZcHBrt
MD5:	E63B56C58FD5A46E99B617FB41E94E91
SHA1:	D1EE81E59423BA5AD51A347197228C1C78C33B94
SHA-256:	AFD796A227D93CBC010EEB7511D9E259A834CEE23D5435BCA61C9CB78A03F40F
SHA-512:	AD9AFE3373088CA5A682E94670375F93FDA80A179B1E6342A42C52F82FD754312D2B29F8BC26D1C67F3469834BED26F98DD6B67C7CA48491951F423E5D06469E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ee04969cb55f4a27a3b91dae2fad697c.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:1026372e0qGzc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.565035187018191
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsfQEhUcII8jFQMzKaBu:qgFqo6g7/+0+f+MsfQKFII2Tmh
MD5:	9049E82B5A8CAB57A96C07C233A818F4
SHA1:	4466A0BB4F0A10CB090B48E3018BACFC1E49AC79
SHA-256:	EC48CB837484ACCB3C9DEB1DAA1182B259E96D9DBD368969A915A4E16FE0795A
SHA-512:	2DF7045F8C8B3C049BDBADFFEE3F8D21ACAECF2C15071F26256B3CDBB4ECC865E7D7AF5E94F62B6F9D7FC502E7D8D8BB43829C22EDA07F12BAA4E18D1C78E8DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc1f5ab2146748839c116780593a270c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1026376uKag7e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4454526140493185
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MDZSg3BTBjFQMzKaBu:qgFqdg7/+0+f+MDbBTHTmh
MD5:	3A9010EE4BD97CA2ED5661EA106B4808
SHA1:	D3369BE1FD479FA2ADF150755262C413A8795A49
SHA-256:	EC90020B8BBCEAC7DD013E572BF9152290D37E32F85605F8C7425C7DF9797331
SHA-512:	33B10657D654F6233A0B940BDCCAFFEB8EF08133D8627050D8C0594112DD894C0964762017A83F3066B59EC7147AE827850A2DE9D153B753CD42C00F9FEF9107
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=909e9af046cd4a0b956afd94334246ad.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1026583x2v5Wf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.381109265231776
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9aFSIDP0SD4uqjsiI:SbFuFyLVIg1BG+f+MAPXZqjZcHjv
MD5:	A5DA83C76131A9B1F8A1BAC65C71E9D8
SHA1:	D33DBB7FA55309ED2D4074B08823841F573049DC
SHA-256:	530EED44707DA228F8D358FBEAE52BB1B583B27A52F55D65D838967773B11928
SHA-512:	598C2B0E470E99457B820C88543606AD12671B6FB8B20791F5704FD16DEF63D83D32A0947AC5C1028CC2BCD6760F27085E1D8894A37D302F1324ED8EA4633D9C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=791d97ff6c204836a8466f15da87ff39.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:1026631dqHulf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.349379905220712
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8LR7020i0hglsjshQ:SbFuFyLVIg1BG+f+M8Vd0i0jtWL0
MD5:	F53F54E6E91652B19C3E388481A054A7
SHA1:	7519760BE76007BA9596BBFC06B6558D6F31C66D
SHA-256:	193221E4951ADBBC5B40FD63375537FB1F9ED05CAA004B2D2A2AD79192FDD4BE
SHA-512:	6B4274CFBD391038DE6ECB4E5702F9BA9720B0BBF39E54AC94B8BC4FBF7BA90F0FCC38379B8899065F385C6449F3773B3B171D414CA971F47A15683E667FFA2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68a9404bf67740a98db19bdb025c4baa.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:1026773u0aove

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.379367982406795
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+4HBQEIBiRE5Tg689:SbFuFyLVIg1BG+f+M+4Gt55Tmjoa
MD5:	04A65ED117B0B5E22DCB040FF292F7B5
SHA1:	05A2373EE384C17E281398E63E05ADB4731F87F7
SHA-256:	ED17C11B9110F30093DCD7BC38E0C2A521695C177E9230B7FBCB231295D0D54A
SHA-512:	BD3A0D460B89DF97DDCCD803F4C103C4102FAC19DCAE15EF51809DBAD4D466C43E4157A7006B657B66F96B097A7E34672E296D84AAC822BBCB1309529D8BD538
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49dd462bd5a14d819c4c61cdbb267595.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:1068486dxa5d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.519535576828572
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuNVAsEGVe+AIUvAgp:SbFuFyLVIg1BG+f+MuNqsEge+Rji4s
MD5:	97C22050E4333A3C37A3594454897D77
SHA1:	0BC436AEFAE974079BC0D54777120A2EFD467A5B
SHA-256:	5BF34A64A247BB29B5190564351D4B4A312FCF4719F4CD8072A1F4D3D07B8759
SHA-512:	198416233B290CFC855ABA2CB985C7CC97CFB9115111A4D8E8489B4B5ED3FB5605B08562DCD2A65180E6B35CDFA42596C3050F0D6F24C8BE0D08C037D735CF01
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da2500e289f3424c9c5e675d4fe5af71.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:106849Gl3owe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.416118462269792
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4C19OjgG3g2josQu:qgFq6g10+f+M4CXOjg2Qu
MD5:	F4452277F2CADCD0B9E5932B21CFF6CD
SHA1:	A964A4DBA27FFE068CF3D63D99FBDC5749109216
SHA-256:	7A17A64947C7FC4DCDB43EF9E689813192CCAED84DAA1DC5228F8763352BBE30
SHA-512:	F3B77B19251768D66B86C88F46463287B29CBDD530D18C2C5C2576F036DB82C09A6495936E0EF603E64E9B0555CF782C5C0CAA8AD68D3537B197E73D1A920ADD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=240d611cac254a298912d05732d17c23.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:106857KuoiJe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.466407070372657
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6dGR3THLdyuUhTjsV:SbFuFyLVIg1BG+f+M6dGRsTjZcHcljX+
MD5:	77169EF2C33BBEFFD3D2AA043150E7BB
SHA1:	8763AE791832040BA7655BFA6B8D65E2F7FCB1D4
SHA-256:	C33E9B18631B87717222862C30E4351224CD88C42B1409851DA55F07873F9AC9
SHA-512:	5DBB1E0740E1E5ACB75501607B9E427F302CE55DBC22175464C4C47DF7D9CAFBA71532249214E72410F6A4F70BD393B61EC8DD63DA2282EC9CE461BCB7AAA205
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02009b7a4b484446bc783a28da88c327.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:106866RsdAYf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.401621672065738
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8BSIWR+6iYTjdCLKzK:qgFq6g10+f+M8BGVCLAK
MD5:	8147C064FB7D390F8A4B6C0FF4657AED
SHA1:	505DB47885D5A33BC999EA2C591921F51158DFA5
SHA-256:	2072DEA7D7CA37CF4124F3AF2F3BE57F431FA61A1A22639D6067DBFC97707CF6
SHA-512:	B711C1141F8898D5F65AFE3B02D65F7F14D66149BC8C907110EEA8FCB9E5DF31E459F13337FB5ECD49B4756DD721EBB788093EE8A5AC2C3514768BB544832739
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6d7fdbd1869f4a2cb7e51901b80be640.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:106867UqHFGf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.503912512006311
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5pGHQVlJExSBGpqjq:SbFuFyLVIg1BG+f+MyHfgEpqji4s
MD5:	A92EFFDFB26FD432C6B7E008FA73FED8
SHA1:	1FE8CDC8CAD2BE61937104097C828BAEA82C7CAA
SHA-256:	0B26DC0ED7DDC350B2200BA1A79DAA3DCA0BE36FBD6E457948FE8CFA0385845D
SHA-512:	FC5F2892B9C3E6683628A6C3944FCD695D01DB152CD8DCE893CBDD24B5D7219D61BDBE405B58DE76796E1EA67697DDA197E6A070563F937CF4F65CDEA444B949
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3aecbee8b6904121bf0a429e1d3d245e.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:106943tAG4Ef

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.415158465118459
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/vNScMwREL9dNrqj+:SbFuFyLVIg1BG+f+MgcVOL8jLkGq
MD5:	43D29C4770361FCE928983C2976CDFF8
SHA1:	876808DE9FC9D4E86B9E605E7C83E1B789952921
SHA-256:	99FF55227A4E6BA1F8CB0C4C5B3DAE48D6BD55E76879DA91BB135347A1902386
SHA-512:	EA2380CF591811D5DD8361D3D398EDB71BE9667AD7E0FED134546095F06DE15B4F57A533CE1084AE66D8E9E6861471EC7AD0883EA6B55A9E828C40F336BEA2B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ac28796ed16418c8bb282589aefdfe8.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:107022aNcSOf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.422331260848443
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4x6PxGAUVAUQToYXsjr:SbFuFyLVIg1BAf+M4x6ZGlxGoY8jNTZD
MD5:	F7D82E8098E3CAAF03F2293900036793
SHA1:	BB16578C68146C607FE5E99F4ABFE1FF3522434E
SHA-256:	60B51874665B24CDB1885CC0548B772992B23769A6364376BE4552488A43D069
SHA-512:	ACDD025CBA465EED5C35EEB58EC842F50F7CA873F89894ECEB27B4891C4342584088644977AA58974BA9AF782A58690E976C3AE75ADFABF0F3EC3DEA2F6F8BB1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=274738171fab4ce2a5ee156ffd365592.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:107124vZUXUc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.446453084757881
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+GmEkWMqjLTTIWTIL:qgFq6g10+f+MhM+EWEL
MD5:	B4EB684E98F2857952468D0D313F791E
SHA1:	3C2DD769F9192257C9A2C3CCABF1D4727D63B483
SHA-256:	085C2C391A8BE013402D7458FBC745734C59B20DCA2F32E3B7B3C2750394F0C7
SHA-512:	FEF8D130237E5322161F76776846255221655D6088645A0B9B518DB14D43B3769F80CC22AA3BBBFDF315E919B5B294A79EE92DCE627B7FB20D49A29EBF7C5BF8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49598bce4f55479fa61fefdf939c3683.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:107232tYBEng

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.401387872403268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyLxVdaHxSvPfV0h+N:SbFuFyLVIg1BG+f+MyNKMN0jbVC
MD5:	B09902116D777AF090E78D611C9EEC31
SHA1:	4E8DAD4C2F43E86B55203F956DE7BCF7E00175D5
SHA-256:	3FA5D376BBFA93AF00872280A2DA3A3B33EE03AA1477A52545182804E8CCD599
SHA-512:	32FF683011EBCD6D2B367D098FE92E7BBA71B37849E11A56905FE0B8CCAE0FFB57DF64C4EE92F76DB4EE946BBE27926AE9F826F0905EDFD2C01A777090FDAF4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8f24208bfa2b427796fc82041e4ebaab.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:107280q8pKAc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.422340341917688
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzz0BB0TXBdQRQTB:SbFuFyLVK6g7/+BG+f+MPfbE2zCTjNq
MD5:	56D26339D586AC7F7EFF90E6414EB9E0
SHA1:	247873A7DBA8C642530FD9AC1CFFA30C2B007429
SHA-256:	4C946512BB9DB6A8251FB13E9BC7E14BFFEFDEC85441B81C899DF0AFBDC7EC57
SHA-512:	8D4E0E4B99664102D0E1998DDBB1B24C6DD785A857A3A47705FC769A82FEDE138E0112D07D90623225F7FEBBFF3EA74BEFA8B891209686CC9AF503BE208B55F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a6b7b1dda04462d85cc5632d25cb012.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:107282IuXMbe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.421101496173144
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvuGVHRXnBVzh+qw:SbFuFyLVI6g7/+BG+f+MRXnBVzhljNq
MD5:	DEEBA73D2209FAE851580EB9EE0A848E
SHA1:	8E3AF55C1C2F283E1FD94319A4E994B9CF7504A3
SHA-256:	21206EBC7D98A074A78E6002170A5439311366E9E14FE26A8EF3C911E573D85F
SHA-512:	579FF3F38B5CF1676F44A7ACAE9D6164930801938CB4E2C16E5A48102FA97CE894E07059BE5F1E565BE754B56C8577775C9AD35E5670845B744C3C9313F372B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e472c5e28512421ab8d0576eaf1f1377.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:75614wE2q2r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.479515338226386
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuskEHnGntu1EOKRq+:SbFuFyLVIg1BG+f+Mu76KRqji4s
MD5:	92C55A9D0312D3663514192155D0B947
SHA1:	EBA24740EFAD59AC4930944B4A4D34FA15A4B1B6
SHA-256:	13AA59F4C4A59C3F67D46FC40F97FAE273D1C4642A19F0B4EE15B9178C21A01A
SHA-512:	C4F156F57BBF1CAD4753C76A38C9F3C332147B117666C5F07C2D8ABB1EAA112334CD2E06E764AFD359C429E14EB22729F472D2421C3368D75B26B343D2460A3B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df571d72a22d4cd4aafafe5a4b484f3e.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75615K1VhLr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.515443158069633
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoqHmjfCh5qjs7LbgS:SbFuFyLVIg1BG+f+MoqH2qKji4s
MD5:	68719476DFAE206B827938FC397B4EAE
SHA1:	BF5D19A091834C4780595A1CA529E17D3508451B
SHA-256:	D07A39ED17D6C33C75C7B46DD8FB8B5B258685E838BDFE9DB915DC167337949E
SHA-512:	29E44DF8D21F15F953D726E02EA1ACD5303E0DE68F7512F65E9997E5F413A069309381C2F76877F3A1E27B69295046401A34705CD2A172E505D6DB3A2A175CA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b0ebb62cc9bf4ae1b5bd822b7c6b4cff.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:761059ixoXu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.395391437847312
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpr/cOX6Bi0huxsjsc:SbFuFyLVIg1BG+f+MyJKqjosQu
MD5:	12CE5D57FD65454939F01C8232A3F384
SHA1:	6276F069C8B01684A0AA1FA896A1C163EDF5BE78
SHA-256:	DFBD13C4D7C370B767240B6B62E74A2AFE424390098B2673AA14BD4ED4A7DFA7
SHA-512:	924D7560885D39967796516590D13AD926F6CB53685F1F6383CB07EABA4CC2C2674F49BAB4EC9562FEB5C05601E061EC53FBC3D7C4EBF5651F8C247369508584
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8385bdb63e04a9da756b31c02b05dd1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76115h7C4ew

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.389058316046088
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6AYbRRXAMwhF2jsmM:SbFuFyLVIg1BG+f+M6AcQMwCjdCLKzK
MD5:	D3CD222F9F2D6AE76B01FDA6BBF3F912
SHA1:	3494C1266B1A1F607EEC75FDCA55DD8A4604469D
SHA-256:	95C28F0881A881AE3CA1D6B4271C55E1BE4B58F43CD0ACE1BAFB3341DD7D8E83
SHA-512:	500EFDFE59464847771B58901E0E5B3359B618F6A51DD3252DAA321F2F674F5C8CF23150A981D5CF550EDE1755C7D4045EA3C2414024CC662843E3E89F1AF968
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=007e7611843448fd8b8e7bdd82b64515.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76117Jo0Evs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.4473945624942335
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8QSpy5DGYjFmzXvn:qgFqo6g7/+0+f+M8H0ESQXvn
MD5:	5C8C026ABCAD9EDA5B5E1F43C6FC0D67
SHA1:	BD548CC460BADFC87638B16D2A94721B50989838
SHA-256:	4FE5E24252B82A813434CA2106B688F49F05ED9C88EFB80FFBAE9A02987F00AE
SHA-512:	C7C06682477893B9A1CA617478ADC360B4DBFFA5DC5334820A397D745427F38206573F3E7914662F41FB8EB64F57EEB9E8E779B0A2537DDDD0A1CCF85BE4F29B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6cb7c6e4c47d43d3827bd0cfd689216b.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76131otxl5t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.372073872737839
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4vKLAcvoF2jFmzXvn:qgFqdg7/+0+f+M4CRgEQXvn
MD5:	45663564FD3A59346407361F89159BC1
SHA1:	E088F1AB7FE1BB7BF0E0545C62B8AE5F244E29CE
SHA-256:	A7B7C91AF6F6EF3A5061DDE4A16007F503E066A03E0605BECC8309427A8D1AE1
SHA-512:	4FD8E520A86F753770987E4944A3DC42837C94A2A93613964C6DBCCB1AC0247772E9EE4FD7D0CC2E7E56D9E021F571362706F6D1DEF1A0CA954189CB2D92E341
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=24f79a982a9c470e850e79c9aa729102.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76132WlfvTu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.374003258854172
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsEfRcHzyclrxsjshQ:SbFuFyLVIg1BG+f+Ms62xqjtWL0
MD5:	8DE479561BFDFDC799B34A689C8A6EE9
SHA1:	7CCBBFB111146D28238CE0E97AA665EA2EAE83AB
SHA-256:	328FEBE35B797BE1EC6B32B2D6A72BCFA02E307EAC9863C129413C4D7E29C3CF
SHA-512:	2AA0A0AB93F5EFD0783FE2DDAFF0A06B68F200A67279273942EEF9E1C524E50F896432FD6AC99C71F951F778A2D7AC1229E9725DEB65120A58C30F05E6765CE8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=faee276991ee4d869bd1524cbc249c1c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77259ry5BAu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4153152661283555
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7AEGtrABncojsjOdy:SbFuFyLVIg1BG+f+M0tqncojNE
MD5:	36DE371B92CAFA55F917F09352D3FE3A
SHA1:	13AB470FF980D308D1D91053B61CCF2FC47F2EE9
SHA-256:	672C8FA17C031E542A41D1E357072F91BE2BB76253EDC4D9DB027A5E4FBF098A
SHA-512:	E813D088ED183C7681BECC197B8880CDAA9866BB963996DC5349BC0E9A983AFAE081FB314023D084214550AC663AF2B0B7153615ACD38B020E8732C207B6F19C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13b8ebc4eedb410bb1d8d95ef8939c56.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77263rKzXos

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.498399372201367
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvhQAWAYRoCD4S2LvN:SbFuFyLVIg1BG+f+MOhcSyqjZcHcljX+
MD5:	EDD2AD82B716199BB8F58F2D9A091F9D
SHA1:	C1039A4ABCD02659C3EF59C183991CA8F7A411B4
SHA-256:	616F50FDB72EDB251511CBD3FDBA3333EE72D2E78F2DDD6A0CE90C1C14185F3D
SHA-512:	89EC4BC437C8EC32E75CB427FBC5DBE8309AC22741DBBF57BB46179410D40BF67DCF68BD64139EB16749B78C11B9456F42F6EA34B07174A6A77322D13000C0D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e955e3ead1344384b126c9c8272cb6c9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77284ZJyMYt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.435833696737999
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9I0TjshKJveqDO:SbFuFyLVIg1BG+f+MJTjbVC
MD5:	F30E943C5F0135CF4C3C91EB94C52B00
SHA1:	656D8965BB083A6D0FE159621D9ACF2A0DFB37C4
SHA-256:	F35ACD8EFE9CAC7DB302E7059B071A32F18A18AB36E1D8F774939420C80D5A6D
SHA-512:	FE956EAC90BD6841F27C86935F87D4424DD7F78B9FCE2E7A4997E175DD4DB2DFF9F18DA1F1BA8BB1884C8DABAE685998552121DBD9E7E1BBFEC86DF18ECE875D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ce5c0056f2b407b91069c214838a866.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77308IKeG7s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.437259429262258
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsBWYxdF48MqjLkGq:qgFq6g10+f+MsBdxeT
MD5:	80AE1AB686F1B7EA3811AA8308508A04
SHA1:	7CBDC7EDC8C85868B879C731419FCF4E3F4C016D
SHA-256:	F6E2D8A9E4C44E8AA9C392A90ABAAD75DB08E9C5C1B826299F45310ABB2077F0
SHA-512:	26A368D1A57B5606F2F9289BEC9177F117F19C93CCA77CC84F2FC3A122E6439A8FD74DE5041D141EAA7CC2FC482688FE6DF12D2BC4A2316BD16F3F85DE0C1017
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f9984f6d43164f38bc4fbdb7d32d9613.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77382dqJ6Hv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.441237943606214
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8Hnwg3dS9jNALyAZD:qgFq6g1af+M8Hwg3duIZD
MD5:	75C45932BCD718ACBA27142B25C8B84F
SHA1:	50BA10340F9EC6CBE83742B75036AFF40F19D577
SHA-256:	47437C652A771FBB2D211B08A9C0B0E30ACA7EA83D2F36EA5A6EC77A546FE75E
SHA-512:	9B8EDEDD8E6E10F1A3539F0D8C962403AFFE6A0824D98C96C78BEF601B476E36AEB68F2A895AAF77CFDC7B1A86F00F0F805A189576B7AF50D63487473AB25DD0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b86e27f2f7d475e8150351f171e7879.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77434IoGpus

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.475101541748958
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7EX3LUIyqqQDjrqjs2y:SbFuFyLVIg1BAf+M4Lhj2jNdQIeXD
MD5:	C9A60121011C90DE0367AA34A2469199
SHA1:	CEC705223B0AE948B5CDD1446BEFDD2A04768214
SHA-256:	6F9BD37451F5F49AE4561FA5DA5547B07EBE445C6667F7B8BA7ECFA63E4DDA73
SHA-512:	F20CA3DE356238FAA6116E99C59B7E558795F1C7A1F19E8BA35FCA4BCF98B730B756C41A650D97DDDD9A840CAE63B197FC365DA6630F285526DC36FC99C07298
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18c2b2f8869c481f9f6d9faf7a6cd5f4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77530MOuxiw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.444650182760037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ADilCXXmATjsmNzC:SbFuFyLVIg1BG+f+M+DTm+jdCt/rRMtq
MD5:	2B4488456969848638FF3D866E191079
SHA1:	47034F11EF1C3E1677289AD1481B12A728C1C3A9
SHA-256:	993826A13BE7C6BD2252B241F932DFC44A40992887D1DD53868C5FEDC5F014DD
SHA-512:	E683B66B92B0ED11A5218C54F5F2CA1410DA6ECE953183A23C7F41312178B8E5B26ECD1D603259868440CE9BB11331C0091436D451178E2B2357D25430C7AA89
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=73bfb8122c4a46faaf4722a7e7f56e34.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78118OoBq4t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.375371572567305
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzOQicWbT0RnHyRxsjsa:SbFuFyLVIg1BAf+MT9nhjNTZD
MD5:	9E1BAF2921937110446E55336FBCEB82
SHA1:	40CCDABD166A131D694A48BD774B2DFDBFEC25F8
SHA-256:	C63035911A1225C49A59D8182E7F3E29F40F4BEF6C97DB7B11530251CCD8BE36
SHA-512:	0F7B64B98868A27F0DB7C4C175ACC869F464E0E79C9203BFBEB67ECC0A8EB0016936B15300AAE3F9DEB6618744ECBE81A2DBCF3303FBF01C699115A3C2D16A48
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=946a59693a434d5ca8493f51d66e05eb.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78147Gp18au

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.414383645664352
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzKbZhcdYQAjswxJBU:SbFuFyLVIg1BG+f+MObfbjLTTIWTIL
MD5:	9BD44539C1956837C775777505D89839
SHA1:	E587DDC4F3142287B39FA1575A329FCFF6D16AFF
SHA-256:	6292300F69834879E96904F132949D8C66D871B5EAB76E7E697BCEA2F0EDD338
SHA-512:	F3EA0C3AA6DC340A7486FF4F85C48050F88BAE83335690CA5C2B4CA5AAFF00FB879D6D0000CC3178E6D7F37BCCB121AD471A8570F7FF54D61A4E1700DB60579A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=96c621ed298f49d2b6c68b4c49cada9f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78204Ks7F6s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.356848547388627
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4+XMZAyAgrxsjsz:SbFuFyLVK6g7/+BG+f+M4+AApuqjNq
MD5:	80C3E62EE2F06C7E0EDDBA25B6E5BD9A
SHA1:	ED20A4F6F0CEEEC0877F823C0DD32DD69399596B
SHA-256:	0D18D4EDB9B4E0517DE071D86974F167BEE71EEC0271AC07A999C342FC3EB188
SHA-512:	BAE013123917BFCD6BC27465D41D4C14AB6F185CF31E8DCE072EFD6F2F2078673E5594DEA01D75EA956E69C2CFEE5121BA294E4839DFC4ABDCA2C979346070D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=211aa2054a1840efa21b6d212ec20c7a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78206SLEqzt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.414085775382114
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9JEtcS0GAYyglsQ:SbFuFyLVI6g7/+BG+f+M7Eog2jNq
MD5:	EAFD2AC21756524C52425C4F5F3B3BE5
SHA1:	B591C80A27D2D7589688619E4CD61796CEA44B4D
SHA-256:	0A8291B35FF1FA88878A36F77220A789ABE28B8400F4F26529E6BCEC82752D23
SHA-512:	467170DB0A6A12D8CF8169923692185A6C2B1EC87D88CFC75B669CC5CFF3906AD4E13E1F92874FE77808B3C108729AFCA331DF8D0DC116D98EF4C5B78561566C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=772ebc6aa95b4953bc6770be412356b0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78256guvJ4v

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.45612678033592
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuxP4HRIaQJjFQMzKaBu:qgFqo6g7/+0+f+MsIJKTmh
MD5:	4BF1732A78AD7AD22335CF9D7BBD9F6E
SHA1:	2E7F8321DC13072B854AEF161DAFE4FB7416AC63
SHA-256:	8A454E23DF14C6F9B67377ABD2BC7AA702E01571CF0F13FA60A6F36EB003F835
SHA-512:	7FECDFE84D149D22ABD3EE7A8592DCFFA9778FD41E2D740A7162CB7F57D9731B9F4C59BD5DA5E267BE462E09DCFFFDE52DE9B1CB438888D5CF2203122524F927
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d7ba67d907bd42d6a3813b3389bd1006.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78259o47H0r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.500613608932528
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoCoBGEyQYTjFQMzKaBu:qgFqdg7/+0+f+MoCoFyQYNTmh
MD5:	639E2562722D6777EB15262B973B31EA
SHA1:	BA299350B484F700F306E013514699ACDFCD02CE
SHA-256:	46CC20554254C105186B5C16AC3A1008B576EDE67608A69FBDC1E666C6F9D36B
SHA-512:	0C8491CEAC9623791770C5EC67F597975B507DD913DE28EFE2C7AC6FEFC5D6BF0BF88C5FCFBC7DCE939797B4513B633708D24744995DF86D33CC986C09067BC5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b8e566dd5c55433e8b3e78e4df86c462.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79290ZR8dwR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.458881821513188
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm92n2AHDTe+IFjHvso:SbFuFyLVIg1BG+f+MknnHRZji4s
MD5:	9D6886CF37C2B47BCA59D8242BC01C57
SHA1:	87BBE0A3AB8645036B2000C2BCB4EDC49900406B
SHA-256:	BDA9A6E2A8AD1F8D20DEC529B4F5C2A88FCF9DC8030AE477BE889AC00C359B29
SHA-512:	4222AB480B7B6D58F82520AC57F67EC038CFD5ECAEE83AA9B7C2FFB0012A1412991AF54CC1B5A47C8F331EC545DAE4F5793B14EEB12590DA20925E298544BA1E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7e0fb3e09ebf4f02bbe31b01f18b9bab.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79293OeP8CP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414559602382671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvppb2mQdZjs1Hadme:SbFuFyLVIg1BG+f+MX0ZjosQu
MD5:	41BFCA54038E0CED990893F7490C6920
SHA1:	3ADED060601D038B885DF790A90584C0E48F3DE0
SHA-256:	5ABD4DE7EDD78A45C13BDED4758BB18DE1CC1E779DAE39FC560633E7046BE1B2
SHA-512:	2DD21B7B48A0FE275E6DF4AAE66D17627F41A7AF9CE1E3020B49E8EE8AE146757C4A11C25787C46D9B828FB7E52E03EAFE53F3D85B542135718DAF62EC10B013
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eae9bbf6fdf74e7e8c8b4354658eac57.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79320K4KGRQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3971428818561815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm77U31PQA5qjsmNz0/:SbFuFyLVIg1BG+f+MvQD5qjdCLKzK
MD5:	8792DD30454228C16F5F052AFC7BB034
SHA1:	5B7E3385785FA7942C05445FB824638005C71356
SHA-256:	4374DD57CA71C8DA260C046FF93BB9DD2B413D3B0A0C1CC6F901B6978F3367F8
SHA-512:	2706571825E673896F8CAB53BEA79DEC5E996277CBA98CC9216C17BD94E01F20E08E2290963F21B58AD6DFD731EEC350612356EC24183DCB4325031AF519EFCA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e91720d44e24be586883ce3667f255e.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:793218sEJjP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4939427813316115
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoDEdqSI/yjZcHcljX+:qgFq6g10+f+Mow6/smAu
MD5:	C9DE844FF9F68EB549568064ECFA3CD8
SHA1:	657ADC09F9E7FD7DF68D8019FDDD9BDA9A24D48B
SHA-256:	8E2BB6C7B2A78A772A858A9404463B47B48DE5E871D7A00CE19C51BBD6FFDCF0
SHA-512:	DAD0C95F3034C858DA7A13A0BF59503D70B96930389E22C95FF8DECA41F5E0EEAAD59AE1DC059980622D85603C696F88B18CA2317EB3C8E0609B3ACFDF27781F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bfa8cf4f0c4c480fb1069775bd78c306.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79330Ijah5P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.449777748290276
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsBSdg+NVv8jNALyAZD:qgFq6g1af+MsBQxF+IZD
MD5:	363870C158902622DBEA4471B2EF646B
SHA1:	88F414E3BAD8D5D21B7EB8F61143E6F2E56B9CF4
SHA-256:	ED7AF29BE200352B00255F1ED646FF2A439D173D256E890D09A445493CC9D014
SHA-512:	4D88ECFB8B28A2BA5F7F312C60FC87575436A8701F69366DB04BEECBC844914FC41BAB30A744C8A513C59898FFD96D62782B0360997F3D2F876D141B1E434807
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd7504a0bd26469ab5acc795a88916d0.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79331iwkslP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.52944387305359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5IMnx47g7FvWvshul:SbFuFyLVIg1BG+f+MWqyg7TZji4s
MD5:	2CCC34F3CFA98AB873105C7BBBB4B86F
SHA1:	7A4A277AAE1ABE8ECE756BF3B01364565227C8F8
SHA-256:	F6A2766D30B59D8BFC6F70FBED2B211DF20E20B97EE798B3F72ECD0C2D002B3F
SHA-512:	4E9A35C3B78C235FC8B8E91EB494BD1F65996D73AA8CD96413B0B18719B228FF91B7619FD9D17B94CE055B5501497916036001099446C5F6A439AC8118D18C3D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=36a10fbf9e074894a7c7fda55b2edcd4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79332YkGOTR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.397234126953993
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm41EzmV2JvsjswkClK:SbFuFyLVIg1BG+f+M41EW2CjLkGq
MD5:	14B8495F7A381EACB580D402634752D3
SHA1:	4CB9D633D79BEA7339F86190467481DB1A1818E4
SHA-256:	1E54D85FDFE618B594DD5A4991D252E1051008C34A2E6591EA640B96886BE414
SHA-512:	9253730B197291BDC7C8B2ED64097186428F32E0AEEC2409AAA3D50250877AC8A752C6AE0281C48AFA5ADD7F1021030EB0CF657DA30F05409765D6E1102B2BD8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=217d1acb18d94b38b6aec8fc60d0d1f0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79349T42tBO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.46939884735147
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8wEuXPSt2jNdQIeXD:qgFq6g1af+M8xuIM2D
MD5:	933CFEF0C03F52DBA77FE20433B232E3
SHA1:	B038D0658DD887CCB278CA9A7285DBC71412ACA8
SHA-256:	9B0686A0B0DB045A7177A24A7FE12599088B4B1935135CE834762356A5BB8B49
SHA-512:	8A23D8ACBB3A5706D018D362555079FF17595B8FC0DD70FA214AEEA495FE003CEC6A679FB75CD6132E44F8421CAC980B07D90AB1EE08412E66CF42F9FCE08C93
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69da0a21b5c2495d9a30632d3024778e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/seats/.#seat04RBZGM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat06Cknin

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0OAqRGL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0OoC0hn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0edMjgn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127AFx0BN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.292308566186151
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffm7gkkWBw12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBagpKthQHtPYq9M
MD5:	20E220D463F5FD202F3C90AB8AE1FE29
SHA1:	7CF21F424A915009C2A41670E4138CC1B2F8031C
SHA-256:	30FDC30FB4768D0776F237AFE14EAA28F8F70F868FDCEBAE0FBC4886F1CFB2A6
SHA-512:	B941866B9F3BE49971B442BA3EE6C131542D29702FE4996418058F9CDD593B8C5D353B88809A1C1BCEA8CB3F7CCC965F9A2F96CE60703E90F69C30358B8CFA9E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13281.REALTIME=1735418655173759.MONOTONIC=557457859.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127BtTm0K

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.253221366431456
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgABkWSB5yS5bi206qoduZ:SbFuFyL3BVgdL87iesnAiRJgkkWBwOtz
MD5:	D8B81588FA2383CA5C26FAF07A37A70B
SHA1:	FA9FB028DCB4F1A1E46A1166920A2CC1F1162D7F
SHA-256:	403A1D700D7A0B91A50C6271A25B7A90AA5275FAA2DB81B01D6F7D2C02232F30
SHA-512:	25629EE306D5EE77D4367E05346AFBFA232D56B7329431F5517EC0F838893743D0B1CD20BA30977B1704830E8E13AF62909BE1AF161CCDF3C83659E709D6E409
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735418655173759.MONOTONIC=557457859.LAST_SESSION_TIMESTAMP=557522927.

/run/systemd/users/.#127D2JWVK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.448967147930279
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffegkkWBwOt6oZ:qgFq30dABibB2gp8Ii
MD5:	61B085D697ABB9883D65E04B6CB2E0AF
SHA1:	BE751D449B09B6DD4D3379787E845F801E8701BD
SHA-256:	A28E1BFCDDA322BD4DA252FDF0AD6B55DEEB75074B4211A511217F517CF1C599
SHA-512:	75EC103F0FCD71160656826803F813DB2548D1621AAFE1234780243FAD7B36CA0FAE61B4522652C3B31A4FC9286CE29930E6726E35D10D1F6BAED656AEA64AA0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13403.REALTIME=1735418655173759.MONOTONIC=557457859.LAST_SESSION_TIMESTAMP=557522927.

/run/systemd/users/.#127I0EjFm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.291600300440691
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7glD/2unQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+glaunjthQHtPYq9M
MD5:	FF4B77E33C96D1C70B3A8BB6005E0FE8
SHA1:	7AE4357A296CDF5E54EE975828DB01C45B44AD91
SHA-256:	9ECF85807F3E0F70C52516FCEAA937A56526348305809744579DB941BA295FC6
SHA-512:	09ABC12B7B1196625E13360539C48AC30CA4F31508802910761B94E8890B07434D44FF530B984EB3CFE574A0928099B81D1FEEC5F2E6C65FE951BC69140C29BB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735418574101432.MONOTONIC=476385532.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ZYYlyo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.293555765082909
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA2DOSsXxkH206qodgv:SbFuFyL3BVgdL87iesnAiRJglD/2Ot6M
MD5:	42C4E64E564CDA4379BC6E747CBE77BB
SHA1:	EEEDC17F756FC0FB9AA390327FA89A8DDC267CAC
SHA-256:	B799416BF90A3D4285BBF14982566AAC78135D7F1EF48D3141229D5501EA889D
SHA-512:	E104C89F1DD073480F1D153B9B1FB2FFE57430FD407A3690357E01612A60FB53886FFFAC9EC6C270F02DD41AE94BD26FAD6D1DA073FD17791D1AE8BDA0166D14
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735418574101432.MONOTONIC=476385532.LAST_SESSION_TIMESTAMP=476467134.

/run/systemd/users/.#127c0NWUm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127e2nInM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.448967147930279
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffegkkWBwOt6oZ:qgFq30dABibB2gp8Ii
MD5:	61B085D697ABB9883D65E04B6CB2E0AF
SHA1:	BE751D449B09B6DD4D3379787E845F801E8701BD
SHA-256:	A28E1BFCDDA322BD4DA252FDF0AD6B55DEEB75074B4211A511217F517CF1C599
SHA-512:	75EC103F0FCD71160656826803F813DB2548D1621AAFE1234780243FAD7B36CA0FAE61B4522652C3B31A4FC9286CE29930E6726E35D10D1F6BAED656AEA64AA0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13403.REALTIME=1735418655173759.MONOTONIC=557457859.LAST_SESSION_TIMESTAMP=557522927.

/run/systemd/users/.#127l3Q7mp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.444752032886868
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTglD/2Ot6M:qgFq30dABibB3TglaOIM
MD5:	B4AE66F0148D946C200BC964CA438308
SHA1:	7169651BC65374014165E13988BDF1EB40F748D0
SHA-256:	EBAD2686A3A7D3D7EF1EC9E70C01BE8CAF4F63A88DD9EFE022C1F746D89FEB06
SHA-512:	09782E4F775A759CDC09D11C1EB46A85C913651FFC8529D32E18184CE1C092414BC2FBB892DF9F4BDE7EF8A708B2E11CEDF92BBABC26499F547D60A3DBA41D3E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735418574101432.MONOTONIC=476385532.LAST_SESSION_TIMESTAMP=476467134.

/run/systemd/users/.#127o7P8xK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127riTPAM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.292308566186151
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffm7gkkWBw12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBagpKthQHtPYq9M
MD5:	20E220D463F5FD202F3C90AB8AE1FE29
SHA1:	7CF21F424A915009C2A41670E4138CC1B2F8031C
SHA-256:	30FDC30FB4768D0776F237AFE14EAA28F8F70F868FDCEBAE0FBC4886F1CFB2A6
SHA-512:	B941866B9F3BE49971B442BA3EE6C131542D29702FE4996418058F9CDD593B8C5D353B88809A1C1BCEA8CB3F7CCC965F9A2F96CE60703E90F69C30358B8CFA9E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13281.REALTIME=1735418655173759.MONOTONIC=557457859.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127wc5NVn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.291600300440691
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7glD/2unQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+glaunjthQHtPYq9M
MD5:	FF4B77E33C96D1C70B3A8BB6005E0FE8
SHA1:	7AE4357A296CDF5E54EE975828DB01C45B44AD91
SHA-256:	9ECF85807F3E0F70C52516FCEAA937A56526348305809744579DB941BA295FC6
SHA-512:	09ABC12B7B1196625E13360539C48AC30CA4F31508802910761B94E8890B07434D44FF530B984EB3CFE574A0928099B81D1FEEC5F2E6C65FE951BC69140C29BB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735418574101432.MONOTONIC=476385532.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Ljn:vn
MD5:	2585C2ADA8177FCBE502F0E16DBBCC5D
SHA1:	76CA2A6F8BA0CE2EA1F870F34756B60E9787D852
SHA-256:	71CEDEB642EAF09A5023D7606A95AA6E0FC08DC3223F0D69ABCD59F659BC6122
SHA-512:	25F9B79A74DCFF33BEA79AC6909FD2BDD4B54DBE3ABE958000C4DD299928DD6170F73D6A52A7100C10D5E73B0BBB3F0B6920F99C8DE22351D4FA291FEF4372D9
Malicious:	false
Preview:	6716.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:OVv:OF
MD5:	1E92760FCADE3B11A8011B2C9DD3332F
SHA1:	4A9C4D7E61AC5B716C768CD73AD75EC8C87E96E3
SHA-256:	188CD410B072FFFC38FEC7A4AD958C31687C7D754BF60E944C5E64A51FD3D5EE
SHA-512:	716D6FF988B9AA9158D7D1D6B3EDF9B737CAF251B4F686EADB75F2675F456BA237AF32C2DACA223B68D323D3AA6507AD142F42B70EF8927CB8A509058E76C18D
Malicious:	false
Preview:	6740.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6703293272315907
Encrypted:	false
SSDEEP:	3:/CsXlXEWtl/jXev:/f+ylrXe
MD5:	2E65314EC7D5E749BE9A0225226A4B12
SHA1:	4BE3DA93C9DFB38A6E221917503C9765AF6FF820
SHA-256:	6E5F369859413454E6CC9F2CB5251AE32B5D50B800BCA900E0EDB47929C9928A
SHA-512:	CB662724AC354DE76C28CA3AD51B382CB346F62546874DFE955902BEDE6D4CFE8C2746555C69480DFD3A3740EB3ACED3C12DD835AA292295F317A3A3DFF52FB5
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................cpg)Z......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:OQv:OQv
MD5:	15FE1EF58E2CCB1BE6E40CB9D7472A38
SHA1:	DA8FC3045AE1B91D1AD7BB995078D533C3B02842
SHA-256:	5FBADEB35DAB9EC7DE3FEC0945A74CAD29B0B2933C9C509B0A71645B91078157
SHA-512:	A697B691BED560A8F67E1E1D3ACFF17BA1F7D5C4B281244C6E4AD31158BFE8401BDA097FE00AFBA38D1666327A87E487CA4D0CD67DEAF676CBB8BB356547F83A
Malicious:	false
Preview:	6745.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Je:c
MD5:	986E29D0D8C888183B71B42D6411F1E0
SHA1:	FF2D676D4FED4AC7F83358A4C5F4C44484365BE5
SHA-256:	B92AE49933062E1BD2A71BA05BB93C101D1988AE61398FED9C38F0370ADCA57D
SHA-512:	3D887F79C3B60D231028EB491AF3A6747E4AF2AEF567C326D57476DE28CDC9740F41201B3E249A38B8BE3F8BA9D5582B4C011D1083D8D30BFE958C59815EE94D
Malicious:	false
Preview:	6739.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:IVvTSG:IFB
MD5:	7176E678E144645C831A22D1CCF9A515
SHA1:	6D2CEC94775922600B7BCEF049B0621F5906A081
SHA-256:	905E0453997E8434AA687C2B5484379AED58ECC708A6A03B2A59010A3EF8CD09
SHA-512:	6CFF7F3B7659B823375E3329DBACC77FDE6D5DA1D0A4C6129CE97E0A683C614F27664CD1C135E415F3F10716226AAA54409876352640D80F14810FCFEBF77548
Malicious:	false
Preview:	6720.6721.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:OVv:OF
MD5:	1E92760FCADE3B11A8011B2C9DD3332F
SHA1:	4A9C4D7E61AC5B716C768CD73AD75EC8C87E96E3
SHA-256:	188CD410B072FFFC38FEC7A4AD958C31687C7D754BF60E944C5E64A51FD3D5EE
SHA-512:	716D6FF988B9AA9158D7D1D6B3EDF9B737CAF251B4F686EADB75F2675F456BA237AF32C2DACA223B68D323D3AA6507AD142F42B70EF8927CB8A509058E76C18D
Malicious:	false
Preview:	6740.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:OQv:OQv
MD5:	15FE1EF58E2CCB1BE6E40CB9D7472A38
SHA1:	DA8FC3045AE1B91D1AD7BB995078D533C3B02842
SHA-256:	5FBADEB35DAB9EC7DE3FEC0945A74CAD29B0B2933C9C509B0A71645B91078157
SHA-512:	A697B691BED560A8F67E1E1D3ACFF17BA1F7D5C4B281244C6E4AD31158BFE8401BDA097FE00AFBA38D1666327A87E487CA4D0CD67DEAF676CBB8BB356547F83A
Malicious:	false
Preview:	6745.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Je:c
MD5:	986E29D0D8C888183B71B42D6411F1E0
SHA1:	FF2D676D4FED4AC7F83358A4C5F4C44484365BE5
SHA-256:	B92AE49933062E1BD2A71BA05BB93C101D1988AE61398FED9C38F0370ADCA57D
SHA-512:	3D887F79C3B60D231028EB491AF3A6747E4AF2AEF567C326D57476DE28CDC9740F41201B3E249A38B8BE3F8BA9D5582B4C011D1083D8D30BFE958C59815EE94D
Malicious:	false
Preview:	6739.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:IVvTSG:IFB
MD5:	7176E678E144645C831A22D1CCF9A515
SHA1:	6D2CEC94775922600B7BCEF049B0621F5906A081
SHA-256:	905E0453997E8434AA687C2B5484379AED58ECC708A6A03B2A59010A3EF8CD09
SHA-512:	6CFF7F3B7659B823375E3329DBACC77FDE6D5DA1D0A4C6129CE97E0A683C614F27664CD1C135E415F3F10716226AAA54409876352640D80F14810FCFEBF77548
Malicious:	false
Preview:	6720.6721.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:OVv:OF
MD5:	1E92760FCADE3B11A8011B2C9DD3332F
SHA1:	4A9C4D7E61AC5B716C768CD73AD75EC8C87E96E3
SHA-256:	188CD410B072FFFC38FEC7A4AD958C31687C7D754BF60E944C5E64A51FD3D5EE
SHA-512:	716D6FF988B9AA9158D7D1D6B3EDF9B737CAF251B4F686EADB75F2675F456BA237AF32C2DACA223B68D323D3AA6507AD142F42B70EF8927CB8A509058E76C18D
Malicious:	false
Preview:	6740.

/tmp/qemu-open.tg0S47 (deleted)

Download File

Process:	/tmp/fnkea7.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.056020968057881
Encrypted:	false
SSDEEP:	3:TgA78HJN:TgAKJN
MD5:	DDA8A2C2CDBED8242E6613F9F91554AD
SHA1:	B2173D9FBA6CE0674B1BB8C895DFFCD31F046BBC
SHA-256:	5F294B98DEF330F44076FC4698C77B36A72A1F12859E29DE92098CE92361A6CE
SHA-512:	2BFFB04D993D23ECEF225B6AAA9BB7DC3E7A10754ECBF497932C06E0DA7C9A1C95E1617FE01E0685242E4AC9B46EC2BB47AC0F5B20A7F3AE5DDB3A692B336ADC
Malicious:	false
Preview:	/tmp/fnkea7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.LQ2XZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.MQAZZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.910870549873597
Encrypted:	false
SSDEEP:	24:7ZeasYGsg/gC9AvGA2+VZKU820pYrzCJrK9crCQU:kCUmvXfVeYrIrKOrCn
MD5:	DC86F39317FD635E9F7E3ABC0C156756
SHA1:	A34FEC85D91676500259E3AF173CAC37343D6C4A
SHA-256:	66B90213D873DA7018F73D41DBB280BEED763A3624FB7154593D0EF0FC51E4CD
SHA-512:	EC49167458F8A9AC8A5EFD100AB434596100EDAF5EA92B9DF2DE3F0638EAE9AC659B882C484511217F16F89C02DD8BD21DE12D1DF445419477DD4B5A810585AC
Malicious:	false
Preview:	Dec 28 14:44:07 galassia systemd-logind[6620]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 14:44:07 galassia systemd-logind[6620]: User enumeration failed: Invalid argument.Dec 28 14:44:07 galassia systemd-logind[6620]: User of session c2 not known..Dec 28 14:44:07 galassia systemd-logind[6620]: User of session 2 not known..Dec 28 14:44:07 galassia systemd-logind[6620]: Session enumeration failed: No such file or directory.Dec 28 14:44:07 galassia systemd-logind[6620]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 14:44:07 galassia systemd-logind[6620]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 14:44:07 galassia systemd-logind[6620]: New seat seat0..Dec 28 14:44:15 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 14:44:15 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 14:44:15

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlGBheiTatl2BheiTaPX:F3WBheiTaX2BheiTaP
MD5:	D04E85D2B951F41D35AFEFF4AE85F7A8
SHA1:	B6B3845DC7722794BF5012C8C65F11415744E0EC
SHA-256:	6A40E8F5AE46865DD4751E4FEAFEEA99EF87D2116D189EC555B8CB4C10F403E2
SHA-512:	635123A8A5FE50F77BA012C3D98116D671FA617979ED0A36B32243AAD838079EF05A43745C82B2C2785DC4D3EAEC7165EAAF50AD9DC31F4FB81E093AB8862AA0
Malicious:	false
Preview:	LPKSHHRH................u...DE..R)..k.?................................u...DE..R)..k.?........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlP+PLl1+PZtl:F3mzeRtl
MD5:	F8BE7AA8C09C7103EE1F2038274A013B
SHA1:	FC56A125B88871DF38B158205E728023F761C92A
SHA-256:	D4E2826A6806A04621B319D5162ABB25A9181B56363110980108FCB5DED909C7
SHA-512:	FFDE18D1D407B68A774B7A20A952A1F9790A67981FCE54233F85C21D93FE2C9031DEB39EC62A9CC969D61029A0B826402E822FF385A043ACE3A8E20E41FD8491
Malicious:	false
Preview:	LPKSHHRH...................H.{O)..x]t......................................H.{O)..x]t...........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9875
Entropy (8bit):	4.99272662339878
Encrypted:	false
SSDEEP:	96:gFKJFr7rxTDJp2qXfu/8gvHrRIvrRaUWOr8M2JY665JpfGF/kdr8slLRzt7Al:OKTF2WoivAsr8tJyJpfm/kdrht7Al
MD5:	3AF448D5FA90778D24BECD7095AB3026
SHA1:	7BE4AFEDD6A6A3EFF3E4C286B1D626B3A1619524
SHA-256:	2D6C7DA07CCE0FE1B2E52B2E140E3D34925CB4F3E48BFFC72DF727FF1FDF4455
SHA-512:	F4B121ACB4BB81D0D40E2051E99E99B63A367B6F3118A64B1051A33DCB6D7B520730E12A4B2F716D6E0D3F154BAC7953355AF648913460A59E646F2419A4D7F0
Malicious:	false
Preview:	Dec 28 14:44:03 galassia kernel: [ 545.800873] New task spawned: old: (tgid 6673, tid 6673), new (tgid: 6673, tid: 6680).Dec 28 14:44:03 galassia kernel: [ 545.801495] New task spawned: old: (tgid 6673, tid 6673), new (tgid: 6673, tid: 6681).Dec 28 14:44:03 galassia kernel: [ 545.814324] New task spawned: old: (tgid 6673, tid 6681), new (tgid: 6673, tid: 6682).Dec 28 14:44:04 galassia kernel: [ 545.969513] New task spawned: old: (tgid 6674, tid 6674), new (tgid: 6674, tid: 6683).Dec 28 14:44:04 galassia kernel: [ 546.231969] New task spawned: old: (tgid 6674, tid 6674), new (tgid: 6674, tid: 6684).Dec 28 14:44:05 galassia kernel: [ 547.356278] New task spawned: old: (tgid 6674, tid 6674), new (tgid: 6674, tid: 6685).Dec 28 14:44:07 galassia kernel: [ 547.478384] New task spawned: old: (tgid 6674, tid 6674), new (tgid: 6674, tid: 6686).Dec 28 14:44:10 galassia kernel: [ 549.579871] New task spawned: old: (tgid 6679, tid 6679), new (tgid: 6679, tid: 6690).Dec 28 14:44:10 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	27803
Entropy (8bit):	5.118788443957656
Encrypted:	false
SSDEEP:	768:fCZFz6XD7vV7m3QYlfW56cvJSmwCZnzFQBVv+0AaQYEKrtRft3zZYimsl37Jr:bXFj8cvla
MD5:	A4128B7B4450D5AC409C3DA0A46B9FAC
SHA1:	86852C0533A4D1FA0F155F142CA4880F14D2E797
SHA-256:	5A6A0B39E8FB0BB38C3EAD2FC0582608BAA7B6CA40707F95641E92E2520A4528
SHA-512:	DDA700C306497481C3779B7965EB0B553CD8B37EB805A61EFC8B93D47DCED57FE787546B5FA0CC9BF96087E51CBD64B9A7A7651AC938EA833D731E28B78FA100
Malicious:	false
Preview:	Dec 28 14:44:03 galassia kernel: [ 545.370232] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 28 14:44:03 galassia kernel: [ 545.370368] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 28 14:44:03 galassia kernel: [ 545.381877] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 28 14:44:03 galassia kernel: [ 545.381883] systemd[1]: dbus.service: Failed with result 'signal'..Dec 28 14:44:03 galassia kernel: [ 545.383688] systemd[1]: Started D-Bus System Message Bus..Dec 28 14:44:03 galassia kernel: [ 545.389846] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 28 14:44:03 galassia kernel: [ 545.389959] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 28 14:44:03 galassia kernel: [ 545.390445] systemd[1]: getty@tty2.service: Succeeded..Dec 28 14:44:03 galassia kernel: [ 545.391093] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 2

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6703293272315907
Encrypted:	false
SSDEEP:	3:/CsXlXEWtl/jXev:/f+ylrXe
MD5:	2E65314EC7D5E749BE9A0225226A4B12
SHA1:	4BE3DA93C9DFB38A6E221917503C9765AF6FF820
SHA-256:	6E5F369859413454E6CC9F2CB5251AE32B5D50B800BCA900E0EDB47929C9928A
SHA-512:	CB662724AC354DE76C28CA3AD51B382CB346F62546874DFE955902BEDE6D4CFE8C2746555C69480DFD3A3740EB3ACED3C12DD835AA292295F317A3A3DFF52FB5
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................cpg)Z......................................

Source: fnkea7.elf	ReversingLabs: Detection: 43%
Source: fnkea7.elf	Virustotal: Detection: 38%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:53464 -> 178.215.238.153:33966
Source: global traffic	TCP traffic: 192.168.2.23:50026 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.978489852499182
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fnkea7.elf
File size:	216'917 bytes
MD5:	fe01e8fc0efa451ac06c7f5dd81bae4e
SHA1:	acdeffd6f7f0ed3557c9b233749d6dd91abac905
SHA256:	e13c274c201e39d20436b8c7675482e109c44288adbd2af03d9a26854d38d6d7
SHA512:	e1ea3c0a73dafca19dcbaed677ee975b1660d08ca4cb3c0ba1412d32269e5d0be4b06d82440197b42c9c3b53c2f4d7e70e7360f4d7db9dc84776626e31cdabfd
SSDEEP:	6144:FLziNEEQ/E8OFR3h0sEiaUVB1ILe6uuQdtEwvSw0M/RnPzdcY:F6NHMTc39EiaaB1ILXPgEdwJ/FPzd5
TLSH:	28241945AA418F13C4D627BAF6DF42453333A754D3EB73069928AFB43B8679E4F22601
File Content Preview:	.ELF..............(.........4...,.......4. ...(........p............x...x................................................................U..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	171052
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1de58	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x25f48	0x1df48	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25f58	0x1df58	0x2a14	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2896c	0x2096c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x28984	0x20984	0x178	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x31000	0x21000	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x31004	0x21004	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x31008	0x21008	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x31008	0x21008	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x3100c	0x2100c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x31010	0x21010	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x31014	0x21014	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x310d4	0x210d4	0x2f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x313c4	0x213c4	0x5234	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x213c4	0x1054	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x22418	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x22598	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x227d6	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x2527d	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25c17	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x26da4	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x270e0	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x27b9c	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x293c6	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x29af6	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x29b0c	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a0dc	0x7130	0x10	0x0		29	1061	4
.strtab	STRTAB	0x0	0x3120c	0x3d49	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x20984	0x28984	0x28984	0x178	0x178	4.6653	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20afc	0x20afc	6.1162	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x21000	0x31000	0x31000	0x3c4	0x55f8	4.7007	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x21004	0x31004	0x31004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 21:42:41.472248077 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 21:44:01.482327938 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 21:41:50.962857962 CET	192.168.2.23	8.8.8.8	0x5b00	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:41:51.202863932 CET	192.168.2.23	8.8.8.8	0x4413	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	399	false
Dec 28, 2024 21:41:51.327256918 CET	192.168.2.23	8.8.8.8	0x4413	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	399	false
Dec 28, 2024 21:41:51.451673985 CET	192.168.2.23	8.8.8.8	0x4413	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	399	false
Dec 28, 2024 21:41:51.575978041 CET	192.168.2.23	8.8.8.8	0x4413	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	399	false
Dec 28, 2024 21:41:51.699919939 CET	192.168.2.23	8.8.8.8	0x4413	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	399	false
Dec 28, 2024 21:41:53.875029087 CET	192.168.2.23	8.8.8.8	0xf88e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	401	false
Dec 28, 2024 21:41:53.998608112 CET	192.168.2.23	8.8.8.8	0xf88e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	402	false
Dec 28, 2024 21:41:54.122345924 CET	192.168.2.23	8.8.8.8	0xf88e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	402	false
Dec 28, 2024 21:41:54.245918989 CET	192.168.2.23	8.8.8.8	0xf88e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	402	false
Dec 28, 2024 21:41:54.369103909 CET	192.168.2.23	8.8.8.8	0xf88e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	402	false
Dec 28, 2024 21:41:56.538897038 CET	192.168.2.23	8.8.8.8	0xa423	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	404	false
Dec 28, 2024 21:41:56.663544893 CET	192.168.2.23	8.8.8.8	0xa423	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	404	false
Dec 28, 2024 21:41:56.786583900 CET	192.168.2.23	8.8.8.8	0xa423	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	404	false
Dec 28, 2024 21:41:56.909744978 CET	192.168.2.23	8.8.8.8	0xa423	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	404	false
Dec 28, 2024 21:41:57.034166098 CET	192.168.2.23	8.8.8.8	0xa423	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	405	false
Dec 28, 2024 21:41:59.252969027 CET	192.168.2.23	8.8.8.8	0x711b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	407	false
Dec 28, 2024 21:41:59.376368999 CET	192.168.2.23	8.8.8.8	0x711b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	407	false
Dec 28, 2024 21:41:59.499926090 CET	192.168.2.23	8.8.8.8	0x711b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	407	false
Dec 28, 2024 21:41:59.623298883 CET	192.168.2.23	8.8.8.8	0x711b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	407	false
Dec 28, 2024 21:41:59.746418953 CET	192.168.2.23	8.8.8.8	0x711b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	407	false
Dec 28, 2024 21:42:37.029141903 CET	192.168.2.23	1.1.1.1	0x79d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:42:37.029141903 CET	192.168.2.23	1.1.1.1	0xbbcc	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 21:42:37.612536907 CET	192.168.2.23	1.1.1.1	0xeb64	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 21:42:39.600553036 CET	192.168.2.23	8.8.8.8	0x799e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	447	false
Dec 28, 2024 21:42:39.727000952 CET	192.168.2.23	8.8.8.8	0x799e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	447	false
Dec 28, 2024 21:42:39.854919910 CET	192.168.2.23	8.8.8.8	0x799e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	447	false
Dec 28, 2024 21:42:39.981668949 CET	192.168.2.23	8.8.8.8	0x799e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	448	false
Dec 28, 2024 21:42:40.110157013 CET	192.168.2.23	8.8.8.8	0x799e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	448	false
Dec 28, 2024 21:42:42.293776989 CET	192.168.2.23	8.8.8.8	0x4abb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	450	false
Dec 28, 2024 21:42:42.417980909 CET	192.168.2.23	8.8.8.8	0x4abb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	450	false
Dec 28, 2024 21:42:42.543816090 CET	192.168.2.23	8.8.8.8	0x4abb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	450	false
Dec 28, 2024 21:42:42.667854071 CET	192.168.2.23	8.8.8.8	0x4abb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	450	false
Dec 28, 2024 21:42:42.794390917 CET	192.168.2.23	8.8.8.8	0x4abb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	450	false
Dec 28, 2024 21:42:45.120699883 CET	192.168.2.23	8.8.8.8	0x2688	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	453	false
Dec 28, 2024 21:42:45.244359970 CET	192.168.2.23	8.8.8.8	0x2688	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	453	false
Dec 28, 2024 21:42:45.368436098 CET	192.168.2.23	8.8.8.8	0x2688	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	453	false
Dec 28, 2024 21:42:45.491441011 CET	192.168.2.23	8.8.8.8	0x2688	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	453	false
Dec 28, 2024 21:42:45.615256071 CET	192.168.2.23	8.8.8.8	0x2688	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	453	false
Dec 28, 2024 21:42:47.790687084 CET	192.168.2.23	8.8.8.8	0x8f5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	455	false
Dec 28, 2024 21:42:47.913995028 CET	192.168.2.23	8.8.8.8	0x8f5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	455	false
Dec 28, 2024 21:42:48.037600040 CET	192.168.2.23	8.8.8.8	0x8f5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 28, 2024 21:42:48.161251068 CET	192.168.2.23	8.8.8.8	0x8f5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 28, 2024 21:42:48.284588099 CET	192.168.2.23	8.8.8.8	0x8f5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 28, 2024 21:42:50.505785942 CET	192.168.2.23	8.8.8.8	0x293f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Dec 28, 2024 21:42:50.629441977 CET	192.168.2.23	8.8.8.8	0x293f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Dec 28, 2024 21:42:50.752614975 CET	192.168.2.23	8.8.8.8	0x293f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Dec 28, 2024 21:42:50.876539946 CET	192.168.2.23	8.8.8.8	0x293f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Dec 28, 2024 21:42:50.999583960 CET	192.168.2.23	8.8.8.8	0x293f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 28, 2024 21:42:53.171519995 CET	192.168.2.23	8.8.8.8	0x2343	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 28, 2024 21:42:53.295870066 CET	192.168.2.23	8.8.8.8	0x2343	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 28, 2024 21:42:53.419492960 CET	192.168.2.23	8.8.8.8	0x2343	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 28, 2024 21:42:53.543517113 CET	192.168.2.23	8.8.8.8	0x2343	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 28, 2024 21:42:53.667056084 CET	192.168.2.23	8.8.8.8	0x2343	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 28, 2024 21:42:55.853255987 CET	192.168.2.23	8.8.8.8	0x4957	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	463	false
Dec 28, 2024 21:42:55.977370977 CET	192.168.2.23	8.8.8.8	0x4957	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	463	false
Dec 28, 2024 21:42:56.101299047 CET	192.168.2.23	8.8.8.8	0x4957	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Dec 28, 2024 21:42:56.226236105 CET	192.168.2.23	8.8.8.8	0x4957	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Dec 28, 2024 21:42:56.350944996 CET	192.168.2.23	8.8.8.8	0x4957	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Dec 28, 2024 21:42:58.527131081 CET	192.168.2.23	8.8.8.8	0x39b8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 21:42:58.650475979 CET	192.168.2.23	8.8.8.8	0x39b8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 21:42:58.773639917 CET	192.168.2.23	8.8.8.8	0x39b8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 21:42:58.896794081 CET	192.168.2.23	8.8.8.8	0x39b8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Dec 28, 2024 21:42:59.020032883 CET	192.168.2.23	8.8.8.8	0x39b8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	467	false
Dec 28, 2024 21:43:01.241292953 CET	192.168.2.23	8.8.8.8	0xc7b1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 21:43:01.364867926 CET	192.168.2.23	8.8.8.8	0xc7b1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 21:43:01.488821983 CET	192.168.2.23	8.8.8.8	0xc7b1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 21:43:01.612426043 CET	192.168.2.23	8.8.8.8	0xc7b1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 21:43:01.736083031 CET	192.168.2.23	8.8.8.8	0xc7b1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Dec 28, 2024 21:43:03.910545111 CET	192.168.2.23	8.8.8.8	0xa205	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	471	false
Dec 28, 2024 21:43:04.034207106 CET	192.168.2.23	8.8.8.8	0xa205	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 21:43:04.157485962 CET	192.168.2.23	8.8.8.8	0xa205	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 21:43:04.280472040 CET	192.168.2.23	8.8.8.8	0xa205	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 21:43:04.404014111 CET	192.168.2.23	8.8.8.8	0xa205	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Dec 28, 2024 21:43:06.578524113 CET	192.168.2.23	8.8.8.8	0xacdf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 21:43:06.701632977 CET	192.168.2.23	8.8.8.8	0xacdf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 21:43:06.824839115 CET	192.168.2.23	8.8.8.8	0xacdf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 21:43:06.947874069 CET	192.168.2.23	8.8.8.8	0xacdf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Dec 28, 2024 21:43:07.071284056 CET	192.168.2.23	8.8.8.8	0xacdf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	475	false
Dec 28, 2024 21:43:09.196459055 CET	192.168.2.23	8.8.8.8	0xe09a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 21:43:09.319947004 CET	192.168.2.23	8.8.8.8	0xe09a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 21:43:09.443288088 CET	192.168.2.23	8.8.8.8	0xe09a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 21:43:09.567676067 CET	192.168.2.23	8.8.8.8	0xe09a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 21:43:09.691119909 CET	192.168.2.23	8.8.8.8	0xe09a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Dec 28, 2024 21:43:11.913538933 CET	192.168.2.23	8.8.8.8	0x79f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	479	false
Dec 28, 2024 21:43:12.036745071 CET	192.168.2.23	8.8.8.8	0x79f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 21:43:12.160120964 CET	192.168.2.23	8.8.8.8	0x79f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 21:43:12.283725977 CET	192.168.2.23	8.8.8.8	0x79f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 21:43:12.407198906 CET	192.168.2.23	8.8.8.8	0x79f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Dec 28, 2024 21:43:56.251351118 CET	192.168.2.23	1.1.1.1	0x3a8b	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:43:56.251351118 CET	192.168.2.23	1.1.1.1	0xf60e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 21:44:06.725953102 CET	192.168.2.23	1.1.1.1	0x7b85	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 21:44:32.306370974 CET	192.168.2.23	8.8.8.8	0xb0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 21:44:32.429415941 CET	192.168.2.23	8.8.8.8	0xb0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 21:44:32.552921057 CET	192.168.2.23	8.8.8.8	0xb0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 21:44:32.675856113 CET	192.168.2.23	8.8.8.8	0xb0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 21:44:32.798943043 CET	192.168.2.23	8.8.8.8	0xb0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	304	false
Dec 28, 2024 21:44:35.018676996 CET	192.168.2.23	8.8.8.8	0x2ba2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 21:44:35.141549110 CET	192.168.2.23	8.8.8.8	0x2ba2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 21:44:35.264971018 CET	192.168.2.23	8.8.8.8	0x2ba2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 21:44:35.388180971 CET	192.168.2.23	8.8.8.8	0x2ba2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 21:44:35.511169910 CET	192.168.2.23	8.8.8.8	0x2ba2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	307	false
Dec 28, 2024 21:44:37.727533102 CET	192.168.2.23	8.8.8.8	0xdddc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 21:44:37.852463007 CET	192.168.2.23	8.8.8.8	0xdddc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	309	false
Dec 28, 2024 21:44:37.975677013 CET	192.168.2.23	8.8.8.8	0xdddc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 28, 2024 21:44:38.098870993 CET	192.168.2.23	8.8.8.8	0xdddc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 28, 2024 21:44:38.221972942 CET	192.168.2.23	8.8.8.8	0xdddc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 28, 2024 21:44:40.343919039 CET	192.168.2.23	8.8.8.8	0x73fc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 21:44:40.466938019 CET	192.168.2.23	8.8.8.8	0x73fc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 21:44:40.589957952 CET	192.168.2.23	8.8.8.8	0x73fc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 21:44:40.714741945 CET	192.168.2.23	8.8.8.8	0x73fc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 21:44:40.838372946 CET	192.168.2.23	8.8.8.8	0x73fc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	312	false
Dec 28, 2024 21:44:43.012702942 CET	192.168.2.23	8.8.8.8	0x8ead	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 21:44:43.136115074 CET	192.168.2.23	8.8.8.8	0x8ead	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 21:44:43.259471893 CET	192.168.2.23	8.8.8.8	0x8ead	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 21:44:43.383034945 CET	192.168.2.23	8.8.8.8	0x8ead	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 21:44:43.506046057 CET	192.168.2.23	8.8.8.8	0x8ead	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	315	false
Dec 28, 2024 21:44:45.675723076 CET	192.168.2.23	8.8.8.8	0x2aff	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	317	false
Dec 28, 2024 21:44:45.798929930 CET	192.168.2.23	8.8.8.8	0x2aff	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	317	false
Dec 28, 2024 21:44:45.921813965 CET	192.168.2.23	8.8.8.8	0x2aff	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	318	false
Dec 28, 2024 21:44:46.044986010 CET	192.168.2.23	8.8.8.8	0x2aff	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	318	false
Dec 28, 2024 21:44:46.168207884 CET	192.168.2.23	8.8.8.8	0x2aff	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	318	false
Dec 28, 2024 21:44:48.293572903 CET	192.168.2.23	8.8.8.8	0xac84	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	320	false
Dec 28, 2024 21:44:48.416779995 CET	192.168.2.23	8.8.8.8	0xac84	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	320	false
Dec 28, 2024 21:44:48.540882111 CET	192.168.2.23	8.8.8.8	0xac84	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	320	false
Dec 28, 2024 21:44:48.664828062 CET	192.168.2.23	8.8.8.8	0xac84	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	320	false
Dec 28, 2024 21:44:48.788352013 CET	192.168.2.23	8.8.8.8	0xac84	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	320	false
Dec 28, 2024 21:44:50.967509031 CET	192.168.2.23	8.8.8.8	0x6a6e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	323	false
Dec 28, 2024 21:44:51.090903044 CET	192.168.2.23	8.8.8.8	0x6a6e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	323	false
Dec 28, 2024 21:44:51.213927031 CET	192.168.2.23	8.8.8.8	0x6a6e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	323	false
Dec 28, 2024 21:44:51.337580919 CET	192.168.2.23	8.8.8.8	0x6a6e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	323	false
Dec 28, 2024 21:44:51.460565090 CET	192.168.2.23	8.8.8.8	0x6a6e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	323	false
Dec 28, 2024 21:44:53.643686056 CET	192.168.2.23	8.8.8.8	0xca2b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 28, 2024 21:44:53.766612053 CET	192.168.2.23	8.8.8.8	0xca2b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 28, 2024 21:44:53.889935017 CET	192.168.2.23	8.8.8.8	0xca2b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	326	false
Dec 28, 2024 21:44:54.013050079 CET	192.168.2.23	8.8.8.8	0xca2b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	326	false
Dec 28, 2024 21:44:54.136028051 CET	192.168.2.23	8.8.8.8	0xca2b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	326	false
Dec 28, 2024 21:44:56.278434992 CET	192.168.2.23	8.8.8.8	0x4f56	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 28, 2024 21:44:56.401683092 CET	192.168.2.23	8.8.8.8	0x4f56	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 28, 2024 21:44:56.524924040 CET	192.168.2.23	8.8.8.8	0x4f56	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 28, 2024 21:44:56.648143053 CET	192.168.2.23	8.8.8.8	0x4f56	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 28, 2024 21:44:56.771559000 CET	192.168.2.23	8.8.8.8	0x4f56	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 28, 2024 21:44:58.994049072 CET	192.168.2.23	8.8.8.8	0xb477	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 28, 2024 21:44:59.117067099 CET	192.168.2.23	8.8.8.8	0xb477	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 28, 2024 21:44:59.240266085 CET	192.168.2.23	8.8.8.8	0xb477	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 28, 2024 21:44:59.363811016 CET	192.168.2.23	8.8.8.8	0xb477	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 28, 2024 21:44:59.486888885 CET	192.168.2.23	8.8.8.8	0xb477	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 21:41:51.201262951 CET	8.8.8.8	192.168.2.23	0x5b00	No error (0)	raw.cardiacpure.ru	178.215.238.153	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:42:37.258668900 CET	1.1.1.1	192.168.2.23	0x79d	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:42:37.258668900 CET	1.1.1.1	192.168.2.23	0x79d	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:43:56.483117104 CET	1.1.1.1	192.168.2.23	0x3a8b	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 21:43:56.483117104 CET	1.1.1.1	192.168.2.23	0x3a8b	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-28 20:42:41 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 20:42:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 20:42:42 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 20:42:43 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 20:42:43 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	/tmp/fnkea7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:41:50
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:42:58
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:43:56
Start date (UTC):	28/12/2024
Path:	/tmp/fnkea7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:42:29
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:31
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:34
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:35
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:36
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:38
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fnkea7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6478/oom_score_adj

/proc/6729/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1006571Bybukg

/run/systemd/journal/streams/.#9:1026066GTTFxe

/run/systemd/journal/streams/.#9:1026203J6cKxf

/run/systemd/journal/streams/.#9:10263535VP5id

/run/systemd/journal/streams/.#9:1026372e0qGzc

/run/systemd/journal/streams/.#9:1026376uKag7e

/run/systemd/journal/streams/.#9:1026583x2v5Wf

/run/systemd/journal/streams/.#9:1026631dqHulf

/run/systemd/journal/streams/.#9:1026773u0aove

/run/systemd/journal/streams/.#9:1068486dxa5d

/run/systemd/journal/streams/.#9:106849Gl3owe

/run/systemd/journal/streams/.#9:106857KuoiJe

/run/systemd/journal/streams/.#9:106866RsdAYf

/run/systemd/journal/streams/.#9:106867UqHFGf

/run/systemd/journal/streams/.#9:106943tAG4Ef

/run/systemd/journal/streams/.#9:107022aNcSOf

/run/systemd/journal/streams/.#9:107124vZUXUc

/run/systemd/journal/streams/.#9:107232tYBEng

Linux Analysis Report
fnkea7.elf

Start time (UTC):	20:42:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:42:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:42:41
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:43
Start date (UTC):	28/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	20:42:51
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:42:52
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:42:54
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:42:55
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:43:52
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:43:53
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75