Create Interactive Tour

Linux Analysis Report
Fantazy.sh4.elf

Overview

General Information

Sample name:	Fantazy.sh4.elf
Analysis ID:	1597718
MD5:	7840f7652446ba21a0d3d8f544843ddf
SHA1:	f2e59105ff9cfab228908dd42a2ca00b27097a3b
SHA256:	06127ddfad660b641bbbbb3a1c8ab143be91bcce4aebafb6af071b61dfa7d8cc
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1597718
Start date and time:	2025-01-23 16:17:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.sh4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/43@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.sh4.elf
PID:	6230
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6218, Parent: 4337)

rm (PID: 6218, Parent: 4337, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8cAst5qzEA /tmp/tmp.MfCnfSjdQa /tmp/tmp.Abrss5zYeL

dash New Fork (PID: 6219, Parent: 4337)

rm (PID: 6219, Parent: 4337, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8cAst5qzEA /tmp/tmp.MfCnfSjdQa /tmp/tmp.Abrss5zYeL

Fantazy.sh4.elf (PID: 6230, Parent: 6151, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/Fantazy.sh4.elf

Fantazy.sh4.elf New Fork (PID: 6232, Parent: 6230)

Fantazy.sh4.elf New Fork (PID: 6233, Parent: 6230)

Fantazy.sh4.elf New Fork (PID: 6236, Parent: 6233)

Fantazy.sh4.elf New Fork (PID: 6237, Parent: 6233)

Fantazy.sh4.elf New Fork (PID: 6239, Parent: 6233)

systemd New Fork (PID: 6248, Parent: 1)

journalctl (PID: 6248, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6263, Parent: 1)

systemd-journald (PID: 6263, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6267, Parent: 1)

journalctl (PID: 6267, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6318, Parent: 1)

dbus-daemon (PID: 6318, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6332, Parent: 1860)

pulseaudio (PID: 6332, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6337, Parent: 1)

systemd-logind (PID: 6337, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6396, Parent: 1)

rtkit-daemon (PID: 6396, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6400, Parent: 1)

polkitd (PID: 6400, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6408, Parent: 1320)

Default (PID: 6408, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6409, Parent: 1)

agetty (PID: 6409, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6410, Parent: 1320)

Default (PID: 6410, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6411, Parent: 1320)

Default (PID: 6411, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6415, Parent: 1)

gpu-manager (PID: 6415, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6416, Parent: 6415)

sh (PID: 6416, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6415)

sh (PID: 6418, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6415)

sh (PID: 6420, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6422, Parent: 6415)

sh (PID: 6422, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6423, Parent: 6422)

grep (PID: 6423, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6424, Parent: 6415)

sh (PID: 6424, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6425, Parent: 6424)

grep (PID: 6425, Parent: 6424, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6426, Parent: 6415)

sh (PID: 6426, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6426)

grep (PID: 6428, Parent: 6426, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6431, Parent: 6415)

sh (PID: 6431, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6434, Parent: 6415)

sh (PID: 6434, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6435, Parent: 6434)

grep (PID: 6435, Parent: 6434, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6437, Parent: 1)

generate-config (PID: 6437, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6438, Parent: 6437)

pkill (PID: 6438, Parent: 6437, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6441, Parent: 1)

gdm-wait-for-drm (PID: 6441, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6446, Parent: 1)

gdm3 (PID: 6446, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6451, Parent: 6446)

plymouth (PID: 6451, Parent: 6446, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6468, Parent: 6446)

gdm-session-worker (PID: 6468, Parent: 6446, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6474, Parent: 6468)

gdm-wayland-session (PID: 6474, Parent: 6468, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6476, Parent: 6474)

dbus-daemon (PID: 6476, Parent: 6474, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6478, Parent: 6476)

dbus-daemon New Fork (PID: 6479, Parent: 6478)

false (PID: 6479, Parent: 6478, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6480, Parent: 6474)

dbus-run-session (PID: 6480, Parent: 6474, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6481, Parent: 6480)

dbus-daemon (PID: 6481, Parent: 6480, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6482, Parent: 6446)

Default (PID: 6482, Parent: 6446, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6483, Parent: 6446)

Default (PID: 6483, Parent: 6446, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6452, Parent: 1)

accounts-daemon (PID: 6452, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6463, Parent: 6452)

language-validate (PID: 6463, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6464, Parent: 6463)

language-options (PID: 6464, Parent: 6463, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6465, Parent: 6464)

sh (PID: 6465, Parent: 6464, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6466, Parent: 6465)

locale (PID: 6466, Parent: 6465, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6467, Parent: 6465)

grep (PID: 6467, Parent: 6465, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6491, Parent: 2038)

fusermount (PID: 6491, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6532, Parent: 1860)

dbus-daemon (PID: 6532, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6405)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6230)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6446)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6476)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 82.127.137.245
Source: unknown	TCP traffic detected without corresponding DNS query: 80.49.129.255
Source: unknown	TCP traffic detected without corresponding DNS query: 103.49.181.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.12.46.221
Source: unknown	TCP traffic detected without corresponding DNS query: 130.250.60.20
Source: unknown	TCP traffic detected without corresponding DNS query: 211.192.14.205
Source: unknown	TCP traffic detected without corresponding DNS query: 146.249.180.42
Source: unknown	TCP traffic detected without corresponding DNS query: 196.166.5.244
Source: unknown	TCP traffic detected without corresponding DNS query: 90.153.156.58
Source: unknown	TCP traffic detected without corresponding DNS query: 100.241.79.72
Source: unknown	TCP traffic detected without corresponding DNS query: 223.133.82.198
Source: unknown	TCP traffic detected without corresponding DNS query: 66.83.2.247
Source: unknown	TCP traffic detected without corresponding DNS query: 81.239.98.40
Source: unknown	TCP traffic detected without corresponding DNS query: 182.177.49.174
Source: unknown	TCP traffic detected without corresponding DNS query: 84.112.140.212
Source: unknown	TCP traffic detected without corresponding DNS query: 57.143.127.83
Source: unknown	TCP traffic detected without corresponding DNS query: 149.96.159.49
Source: unknown	TCP traffic detected without corresponding DNS query: 43.86.42.219
Source: unknown	TCP traffic detected without corresponding DNS query: 96.61.191.91
Source: unknown	TCP traffic detected without corresponding DNS query: 115.143.238.207
Source: unknown	TCP traffic detected without corresponding DNS query: 209.142.241.206
Source: unknown	TCP traffic detected without corresponding DNS query: 68.158.32.50
Source: unknown	TCP traffic detected without corresponding DNS query: 81.97.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 82.26.236.105
Source: unknown	TCP traffic detected without corresponding DNS query: 140.228.211.222
Source: unknown	TCP traffic detected without corresponding DNS query: 94.184.251.176
Source: unknown	TCP traffic detected without corresponding DNS query: 153.41.0.198
Source: unknown	TCP traffic detected without corresponding DNS query: 135.142.147.36
Source: unknown	TCP traffic detected without corresponding DNS query: 170.72.133.165
Source: unknown	TCP traffic detected without corresponding DNS query: 146.25.124.106
Source: unknown	TCP traffic detected without corresponding DNS query: 173.195.68.152
Source: unknown	TCP traffic detected without corresponding DNS query: 80.23.170.51
Source: unknown	TCP traffic detected without corresponding DNS query: 176.126.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 1.192.99.138
Source: unknown	TCP traffic detected without corresponding DNS query: 176.195.131.105
Source: unknown	TCP traffic detected without corresponding DNS query: 64.47.250.80
Source: unknown	TCP traffic detected without corresponding DNS query: 101.224.92.217
Source: unknown	TCP traffic detected without corresponding DNS query: 147.225.225.226
Source: unknown	TCP traffic detected without corresponding DNS query: 123.223.36.28
Source: unknown	TCP traffic detected without corresponding DNS query: 18.5.163.246
Source: unknown	TCP traffic detected without corresponding DNS query: 73.65.111.196
Source: unknown	TCP traffic detected without corresponding DNS query: 222.9.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 86.154.58.45
Source: unknown	TCP traffic detected without corresponding DNS query: 213.249.74.237
Source: unknown	TCP traffic detected without corresponding DNS query: 47.192.129.20
Source: unknown	TCP traffic detected without corresponding DNS query: 68.168.89.160
Source: unknown	TCP traffic detected without corresponding DNS query: 192.194.118.205

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53784 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6237, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6237)	SIGKILL sent: pid: 6237, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/43@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6318)	File: /proc/6318/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6476)	File: /proc/6476/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6481)	File: /proc/6481/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6491)	File: /proc/6491/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6532)	File: /proc/6532/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:74658GHCiVL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:74660RyKxvN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:76050FcDFEM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:756386QqaRK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:75650fzmDFK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:76847VhLxcK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:76848OmgViK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:76862eSELIK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:77027hRcrIL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:77069ZY5NnN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:771707V731K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:77187WfCTSN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:774396nV6eM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:77466u912lO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:781590OCkOK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:78161ebfYfN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:78197pzfZVN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:78199Dn9MlL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File: /run/systemd/journal/streams/.#9:79224uwloON	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/seats/.#seat0x3NQso	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127xKlzZo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127XtJ1Dp	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/seats/.#seat0aJZ7Dm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127cYdqom	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127Dv80Ho	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127MY9skm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6337)	File: /run/systemd/users/.#127kxloim	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6400)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6474)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6396/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/6476/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1576/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	File opened: /proc/2302/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6424)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6426)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6434)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6465)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6423)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6425)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6435)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6467)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6438)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6218)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8cAst5qzEA /tmp/tmp.MfCnfSjdQa /tmp/tmp.Abrss5zYeL			Jump to behavior
Source: /usr/bin/dash (PID: 6219)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8cAst5qzEA /tmp/tmp.MfCnfSjdQa /tmp/tmp.Abrss5zYeL			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6263)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6409)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6446)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6446)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6415)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6415)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6332)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6230)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6263)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6332)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6409)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6468)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.41.dr	Binary or memory string: Jan 23 09:19:31 galassia kernel: [ 482.023823] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.41.dr	Binary or memory string: Jan 23 09:19:31 galassia kernel: [ 482.023802] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.sh4.elf, 6230.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6232.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6233.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6236.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6237.1.00007ffd38007000.00007ffd38028000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/Fantazy.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.sh4.elf
Source: Fantazy.sh4.elf, 6230.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6232.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6233.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6236.1.00007ffd38007000.00007ffd38028000.rw-.sdmp, Fantazy.sh4.elf, 6237.1.00007ffd38007000.00007ffd38028000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Fantazy.sh4.elf, 6237.1.00007ffd38007000.00007ffd38028000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.iBMDNM
Source: Fantazy.sh4.elf, 6230.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6232.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6233.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6236.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6237.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6230.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6232.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6233.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6236.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp, Fantazy.sh4.elf, 6237.1.000055f9ebcab000.000055f9ebd0e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6237.1.00007ffd38007000.00007ffd38028000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.iBMDNM

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.sh4.elf	59%	Virustotal		Browse
Fantazy.sh4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.41.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
179.65.228.109	unknown	Brazil	7738	TelemarNorteLesteSABR	false
44.105.89.27	unknown	United States	7377	UCSDUS	false
2.26.139.219	unknown	United Kingdom	12576	EELtdGB	false
45.12.189.144	unknown	United Kingdom	35085	ACORSOFR	false
157.199.114.226	unknown	United States	3356	LEVEL3US	false
78.20.47.243	unknown	Belgium	6848	TELENET-ASBE	false
45.114.131.239	unknown	Korea Republic of	45382	EHOSTIDC-AS-KREHOSTICTKR	false
221.182.134.33	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
71.167.238.16	unknown	United States	701	UUNETUS	false
90.249.54.160	unknown	United Kingdom	5378	VodafoneGB	false
58.249.118.235	unknown	China	17622	CNCGROUP-GZChinaUnicomGuangzhounetworkCN	false
158.131.73.130	unknown	Finland	55	UPENNUS	false
31.147.116.9	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
209.199.205.19	unknown	United States	6921	ARACHNITECUS	false
87.125.78.208	unknown	Spain	12430	VODAFONE_ESES	false
204.126.245.77	unknown	United States	40042	SUFFOLK-COUNTY-GOVERNMENTUS	false
96.80.119.65	unknown	United States	7922	COMCAST-7922US	false
160.75.118.200	unknown	Turkey	9095	IstanbulTeknikUniversitesiTR	false
173.116.239.9	unknown	United States	10507	SPCSUS	false
132.252.103.58	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
159.144.40.253	unknown	Switzerland	34578	BEDAGCH	false
187.116.182.55	unknown	Brazil	26599	TELEFONICABRASILSABR	false
179.77.9.89	unknown	Brazil	26615	TIMSABR	false
93.211.179.16	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
87.163.126.190	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
115.53.107.252	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
210.89.126.246	unknown	Japan	13207	DMS-UK-ASNGB	false
196.229.62.103	unknown	Tunisia	37492	ORANGE-TN	false
87.216.135.209	unknown	Spain	12479	UNI2-ASES	false
112.254.32.231	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
145.138.80.24	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
143.241.4.237	unknown	United States	174	COGENT-174US	false
85.2.39.222	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
187.132.19.22	unknown	Mexico	8151	UninetSAdeCVMX	false
61.36.176.109	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
182.185.170.183	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
90.166.252.218	unknown	Spain	12479	UNI2-ASES	false
138.200.49.184	unknown	Germany	24989	IXEUROPE-DE-FRANKFURT-ASNEquinixGermanyPreviouslyIXEur	false
45.229.19.154	unknown	Argentina	266690	QTYSAAR	false
48.239.22.90	unknown	United States	2686	ATGS-MMD-ASUS	false
130.221.43.138	unknown	United States	85	AERO-NETUS	false
190.142.243.246	unknown	Venezuela	21826	CorporacionTelemicCAVE	false
80.188.65.195	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
211.8.161.67	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
24.192.215.209	unknown	United States	12083	WOW-INTERNETUS	false
170.199.31.136	unknown	Canada	7122	MTS-ASNCA	false
197.216.68.100	unknown	Angola	11259	ANGOLATELECOMAO	false
169.150.29.140	unknown	United States	2711	SPIRITTEL-ASUS	false
57.127.117.170	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
108.114.109.134	unknown	United States	10507	SPCSUS	false
87.21.203.124	unknown	Italy	3269	ASN-IBSNAZIT	false
85.39.150.225	unknown	Italy	3269	ASN-IBSNAZIT	false
145.176.45.217	unknown	Netherlands	59524	KPN-IAASNL	false
126.252.32.113	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
36.106.19.49	unknown	China	17638	CHINATELECOM-TJ-AS-APASNforTIANJINProvincialNetofCT	false
109.128.145.200	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
203.221.150.56	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
82.57.73.121	unknown	Italy	3269	ASN-IBSNAZIT	false
61.111.179.89	unknown	Korea Republic of	4670	HYUNDAI-KRShinbiroKR	false
71.80.136.15	unknown	United States	20115	CHARTER-20115US	false
221.182.45.48	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
179.162.47.228	unknown	Brazil	18881	TELEFONICABRASILSABR	false
73.22.100.188	unknown	United States	7922	COMCAST-7922US	false
139.30.142.188	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
1.135.197.18	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
160.199.171.166	unknown	Japan	7679	QTNETQTnetIncJP	false
4.9.83.124	unknown	United States	3356	LEVEL3US	false
76.155.68.139	unknown	United States	7922	COMCAST-7922US	false
121.16.128.151	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
76.102.16.12	unknown	United States	7922	COMCAST-7922US	false
135.113.40.168	unknown	United States	10455	LUCENT-CIOUS	false
85.240.29.121	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
153.183.114.186	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
101.178.125.112	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
222.84.185.220	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
192.241.84.95	unknown	Canada	55286	SERVER-MANIACA	false
171.89.245.45	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
113.181.75.140	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
91.93.168.214	unknown	Turkey	34984	TELLCOM-ASTR	false
101.134.80.9	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
123.43.9.27	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
157.148.189.57	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
64.47.250.80	unknown	United States	19855	MASERGYUS	false
87.188.7.183	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
32.174.134.125	unknown	United States	2686	ATGS-MMD-ASUS	false
72.83.73.83	unknown	United States	701	UUNETUS	false
85.190.130.106	unknown	Germany	199610	MARBISDE	false
121.77.91.242	unknown	China	9812	CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN	false
2.182.48.27	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
177.75.185.195	unknown	Brazil	262596	JUNTOTELECOMSERVICOSDETELECOMUNICACOESLTDABR	false
95.175.215.104	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
183.247.234.187	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
77.53.249.229	unknown	Sweden	45011	SE-A3httpwwwa3seSE	false
120.128.45.235	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
169.115.140.88	unknown	United States	37611	AfrihostZA	false
66.170.71.89	unknown	United States	10352	WCTCUS	false
206.37.43.154	unknown	United States	1461	DNIC-AS-01461US	false
66.190.162.227	unknown	United States	20115	CHARTER-20115US	false
204.161.102.90	unknown	United States	3356	LEVEL3US	false
14.103.40.200	unknown	China	18002	WORLDPHONE-INASNumberforInterdomainRoutingIN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
157.199.114.226	Lti8kFIBou.elf	Get hash	malicious	Mirai, Moobot	Browse
157.199.114.226	mips-20221021-0638.elf	Get hash	malicious	Mirai	Browse
132.252.103.58	kira.x86.elf	Get hash	malicious	Mirai	Browse
158.131.73.130	XSMX9yI3wF.elf	Get hash	malicious	Mirai	Browse
160.75.118.200	5EHBWChBlT.elf	Get hash	malicious	Mirai	Browse
160.75.118.200	wYEcj4uIwQ	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	garm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	zte	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UCSDUS	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	44.54.253.137
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	44.160.132.115
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	44.29.16.215
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	44.72.30.125
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	44.133.189.90
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	44.74.130.31
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	44.0.10.30
	jaws	Get hash	malicious	Unknown	Browse	44.176.184.129
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	44.117.150.26
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	44.108.74.184
ACORSOFR	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	45.12.189.16
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	45.12.189.25
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	45.12.189.25
	nsharm7.elf	Get hash	malicious	Mirai	Browse	45.12.189.17
	IGz.x86.elf	Get hash	malicious	Mirai	Browse	45.12.189.149
	teste.i686.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	45.12.189.180
	na.elf	Get hash	malicious	Unknown	Browse	45.12.189.180
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	45.12.189.18
	EaJ376VLX1.elf	Get hash	malicious	Mirai	Browse	45.12.189.188
	ARJ5fFBctI.elf	Get hash	malicious	Mirai	Browse	45.12.189.149
EELtdGB	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	31.108.245.79
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	31.77.234.43
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	31.93.83.226
	2.elf	Get hash	malicious	Unknown	Browse	31.111.32.238
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	2.28.118.71
	armv4l.elf	Get hash	malicious	Unknown	Browse	31.96.186.239
	arm7	Get hash	malicious	Unknown	Browse	31.87.128.109
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	31.117.245.154
	154.213.189.141-mips-2025-01-21T03_19_06.elf	Get hash	malicious	Mirai, Moobot	Browse	31.100.133.48
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	31.97.46.25
TelemarNorteLesteSABR	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	189.71.43.208
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	191.47.82.206
	jaws	Get hash	malicious	Unknown	Browse	177.211.183.39
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	187.12.206.141
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	177.177.25.57
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	187.127.44.188
	ti.co.exe	Get hash	malicious	I2PRAT	Browse	200.216.176.144
	arm7	Get hash	malicious	Unknown	Browse	201.59.102.115
	armv7l.elf	Get hash	malicious	Unknown	Browse	179.199.241.135
	87.121.79.19-mips-2025-01-22T04_20_52.elf	Get hash	malicious	Mirai, Moobot	Browse	179.237.174.125

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.monitor.

/proc/6479/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:Hn:H
MD5:	D707782225F64057E1D7AA8C7E3BBB23
SHA1:	875A581BBA8116D5238704ED8FDA9C3AF848573F
SHA-256:	748CDA3878E8E885C9D4E779BDEC5BC58A2D851FD216B35A410FB29AE5E1A496
SHA-512:	23821974916D044A643080CB77E4A62CAE8C0A4EAB254C7189CE50ECE51635A8C61ED02B03B6F418C6CE87EE73BC407C0DEBB095B25EA64C41FB79CB2999E31E
Malicious:	false
Reputation:	low
Preview:	6446.

/run/systemd/journal/streams/.#9:74658GHCiVL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.510307521173998
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpyDFUBRDCCDHdH3so:SbFuFyLVIg1BG+f+MYDFUKwdX8ji4s
MD5:	75EC555DD50996FB3FF8F632C4D65165
SHA1:	A858F1A785DDABFD6A8828D3929B5CB8A47F1992
SHA-256:	BB373965A5F80DA5493FC6284536E7366ACE2FE9CBEF32FAE3733F2B8B273E92
SHA-512:	F68BF469E83622A3FF678EC08F1B019789DF5927E9D214F0969782E584CD7F19B2E77D1D42C1BB71FAFFB8102D126E048EA85655FC01FE1B239DEB3FDF59E5BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce2f551dccc148c2853f3ac446b8b1e4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74660RyKxvN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5106109988822
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5rnR2GSQaToZjs7LH:SbFuFyLVIg1BG+f+MZOloZji4s
MD5:	C618C1F89807ADD48E7B0830CF5FA3D9
SHA1:	D1C94266E2E47E09DFBD2B03C58045DF84078F11
SHA-256:	3977FF8E599E262D84EFE86A990E62341DECC6F368259FF3D1231B5DB42D700F
SHA-512:	896A0F3AAEBA3987470DFFA20E23AF53C8F0632C15BE6880D2038369509AFD1864B5EEE61AEDFCA320971D534D9D7D230BD8BC195E7863FB058149185A23818E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=322d538e2c82499889dc855d6e431c38.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:756386QqaRK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3877859001495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzYDDIVRWQxA945qje:SbFuFyLVIg1BG+f+McDDI/hqjdCLKzK
MD5:	8ABD3A84F4E911DC543719783E73EAA9
SHA1:	BFDF9F7A47E0941D0D92CDBB1A2C8320EFC1BF15
SHA-256:	91306703A9DE447EEF00792FBBF9F9FF9901D4A333D9689A33582AE5E03982C0
SHA-512:	DF892D658046C7C751B75D106074001736551493B7A8CC02098CAE8826928C6BB3A5677D59F87E3E0F3C0137CB9CCB20C32B39F4CA8EB34B7169F5D5064174BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9fa53f6a0fe343528ed75cc218101419.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75650fzmDFK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.380317572724881
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvtRVyfHia22jshQJT:SbFuFyLVIg1BG+f+MsfTZjtWL0
MD5:	5E586F6F92ACF40EE2E33D8BE073A636
SHA1:	36FDB0D37D3C984CD4F85FBBB0B822DC03F35F8D
SHA-256:	E20981A1FE4C7234BD607BB7ADC4703F93A9B31AB543740D3DB70CAC2529303B
SHA-512:	1E62BEFE58F615E9272BBDEBC23973DBDCF4DDA5986D73151D6C72EBFC15F4D418C1AC1569765C4C49402701810AD750013A2C966B5306C70217B43B7840B6C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e994163f1cda43e0b8d8922c2173c9c5.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76050FcDFEM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.401733408991109
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsDXTudhNz0vsMqjsc:SbFuFyLVIg1BG+f+MsDWj05qjosQu
MD5:	B1C74027CD5B5AB4F619B0D1615149CC
SHA1:	4AD834AF8CB1BFAA735A31514A807848966B31E9
SHA-256:	9AA0D79873128E0090B979AD1428DD7727B9FA4B13615869F37BB5388476527D
SHA-512:	DCCC3E1020290329DA5F7331295796D784A86B9D88A4C0B924774D009091303E32D78400F8E7698F679BA87192BB4598FFFE0EEB4B3CAE867C50067EC07402F2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff26d18488fd411085ac3ff818138455.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76847VhLxcK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.501069129033749
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MOTfXsg4SjZcHcljX+:qgFq6g10+f+MOT0gtmAu
MD5:	C7EBD49F4DA54DA30FBA7F3CCD81914D
SHA1:	468B81FA7EEC777B828680F42D0B00D04EF224C2
SHA-256:	A1EDA1CC1A9AC62C47F5CD477122B8739F19B6D79FB2B5E380EEFDC8F8FC74EF
SHA-512:	5C8B5886BC009B7C17AA0E75113342B1819A36D2E80830ABCCAF2BD48DD4A744CC0F098D8125B8136EA6112E5B441596050087518D2DDAD6986189BDD8D49CFB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc66ff27713c4cab9e8ccbd453947fae.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76848OmgViK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.447888078715536
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm40lXXYRY41wQkqjsx:SbFuFyLVIg1BG+f+M40lXX8vYqjNE
MD5:	56C1069CDA7C69B6FFF217E5A983C495
SHA1:	DB0BC5F61174C3728CAEC916F8ADFEED9B04200B
SHA-256:	4A92E6C2F18F205950B6C24FAAAD27B1308700504D61AF7C468467A3601ECA88
SHA-512:	E4BA53ED0CD791B493172041695077CCBBA9ACEBC5CC3075A1639B419A986A85427B50A95DF496F86400691352BA80A0DA92C4D9B699051B8D103121FD3143A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=247d6c50826141de8b04357ab709cb3e.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76862eSELIK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.40017494520577
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm68DiDSd/R0DEVEGTM:SbFuFyLVIg1BG+f+M682DSJRcEtjbVC
MD5:	B5C2C2878D412F370387671EEB4AE876
SHA1:	E30A61A3CF5DFCE742694D47E7302E249B7BA4F9
SHA-256:	4526FCF08DB0A18B8E03D1A0D7F6ED3FD89939AEFB6BD6B4B821BBB0460C777F
SHA-512:	6941D43F9F80F16367EE018525162752F51761ED02483E654EF9051BF47D2450D87F21B555072D4944B433279F613AAFE8AF7F03D7BA252D7BBB8F28BF958B4F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a03aebf78b044738d47b26a018ea596.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77027hRcrIL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3501166551321
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8O5TSKAkvNvAglsj+:SbFuFyLVIg1BG+f+M8yeSOTjLkGq
MD5:	993B5CEAFCEF940BFAFFCEE8AAF4ACD7
SHA1:	EB76B48EEBEAC745811CCB22BDFCAE2753B2F436
SHA-256:	0176D38F6DC14E57D25D53906D3C604AD8761E40A4C85DAC303C84BA782A0477
SHA-512:	189C4622C9214D374EAEB7BCE4B944D849B239589DCE27FED704AF0A9E016568EB6C2A101AD6E9AB6B115171869FB3E6A2C19A26047EC8839B648CE9C8AC8956
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60e9250220a14c69867c8e3eac70a9e3.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77069ZY5NnN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.432680639105649
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MB47REBNjdCt/rRMtq:qgFq6g10+f+Ma7REBLCDL
MD5:	56E3C435E78CBF87E461D8B69B713ACA
SHA1:	8CF2365027E524AEF1712C481F7087C2B9668218
SHA-256:	0E6C4A2864590C3B75BC20456D1BF49EAA174BBCA2125AB3E19B296CF5028897
SHA-512:	4B5686414F27FF661783FDA1E1C74C45D661B4732A5969B0FD26F1A6D4DF3AC4B1EE24FBF56B69613BC081CF9D7903A714E43461BBDFA025A6E7F95682E049DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38d1c7b85c884c38a8c6df8be4f85de7.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:771707V731K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.449289131943758
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M2RrRREvPk8jNALyAZD:qgFq6g1af+M2rRiE+IZD
MD5:	7CC97CE4C2F9E1388579DEB089545214
SHA1:	AEEE6C2ACACE72ED9DAD081770AEBB89460A47CE
SHA-256:	F172E7A8DB335AA911BD5D32FD737C0DB5E994D19DE47C5808F0DFD591E5A3FA
SHA-512:	63D961D411C0EE8B94B3D0E367279DE8016A020B8E43AAF631684A565D660CC391FFCF4A8598F22E64CBD9CCBF1A156C468399AE187A81D37C61658C804913CA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aef62314d871423ca93fb53bfc76c338.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77187WfCTSN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.501259973232906
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MicJ8a0yAITjNdQIeXD:qgFq6g1af+MicSHyAIF2D
MD5:	865830A50BDB1A67430746E6877A63A0
SHA1:	2F45D277EB174B838BEFA36BBFEC768315AA894E
SHA-256:	FA6765DFB693C4EB249C0B32F4699E30709F78A51AA202CE43E7E00F88894686
SHA-512:	F4B622959C50B9CC97A59AE9C974CED156E7E37DA928F3AA47AF1CEBD83034EA02CFBAC758B4C8034810044BA7C77483A35E559C0655AE7E70C8541B20B8FF7A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd1869f0b9634c9b94b7fbc4202ef595.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:774396nV6eM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.360068147654658
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8aeTBVB3avdR6vXsjsa:SbFuFyLVIg1BAf+M8aeTF8T6v8jNTZD
MD5:	0F473134A5950D74B9C9865C4E5B7013
SHA1:	93FE05B3C636997707C078A5A03370E45F8B900B
SHA-256:	1CE8BFE905DF9ED5F0D0BAE8F5E47A5BACAD2F99B4F6D01F6674B5CD993D56E9
SHA-512:	DCBF8DDC2EEBF1067927719409D3906903FCEF1E279EF401EFE7FCA85CA424F5C9205004ABCBCD283C7F797F6B59A27094A0E623960205B5E1710C77EB652D30
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=61f76e0c6d024e708f12aa884688383a.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77466u912lO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.413009132857343
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoyAu90ZjLTTIWTIL:qgFq6g10+f+MoyAuyEWEL
MD5:	35D703CE432DB39633D4E50D5E730BC8
SHA1:	2208EE44222B2559EE7F4238C4C265DBAB8AF6E8
SHA-256:	1EC0132B83888A9B3DD27AE61EFFC1D7D439D7966E71731EE47118DC5BD3564A
SHA-512:	6CE4896915E4CB1ABEA9800E420A9BEF530CFA19121F3C2B0524B855EC79ED902C9F4D48B692F5EEA3238864478082900A09A0CDA7621FF93A0F41AB1ECA613B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b41f5df630064c60bcaa882d44b5cba1.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:781590OCkOK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.412334799021621
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5UXacERO7+r0/Iz:SbFuFyLVK6g7/+BG+f+MLhr0I0jNq
MD5:	92AAE26B0B9BA71FD544E058F3324D18
SHA1:	C1FC1398AE191F7C77DF32A304902FB5BCB2C5D8
SHA-256:	4B9CF010EBAA7C962F03B280CDC1E124F0B08E4A58321ED66BAE8DCDFF8C8B37
SHA-512:	3CD57975B2B5B258FC61349C518F45D597C425D73FFAB7C52EDDDA87D159B6AAB5204BB9A5B5B782B3BD6116D1CA169FC01F0F4BB2DCBE2404285CE0BE60EA9E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3385e821f49a4126886421f66a8a3737.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78161ebfYfN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.416073547499573
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mu/SmQeqFv8jNq:qgFqdg7/+0+f+MJmE+q
MD5:	DF64E2A9E35CA8BF9580A33DE7BEE3A2
SHA1:	561707186145AFF9C86BA827FEDF0E67432EC242
SHA-256:	3C3008C985D74400D23F0081914E029D35A6D01C1AFD5DF64FDDBDD7BA2D2B7B
SHA-512:	2B35DBD4D475B4CDE7EC5534C728EB10711BEF6FECB6D87C1D214CE8BFC78C9811D5BB2A0BE39B6E873275E2AEDBB32A46E123CA928AA865447F4B24BC83BBE2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc3ccb2284854e57bb75b25ee2a69c94.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78197pzfZVN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.524529294510206
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+CwZ37GbhTjFQMzKaBu:qgFqo6g7/+0+f+M83CFNTmh
MD5:	AACB870034B5F5B78C85B4C5BBA1B0AD
SHA1:	1FE843083060BCFA101DAF75EB405DF38E6E8409
SHA-256:	831EE2C277576C24386828DCB5309E4FA34B0786D6B77555D5C4C7924CE27001
SHA-512:	FA8975A098A3B845543D0A8C1A5B9661BA4F1019BA6CA5825B771F9BEEBD8FF3EC85B2FC57467E95159044DFAFF74ECD1729D7734A9AA3E0E82E38C5F7C723D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=479e3c4349144999ba60061f2379c517.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78199Dn9MlL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.48073789754559
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mo/pMb2jFQMzKaBu:qgFqdg7/+0+f+MowETmh
MD5:	EC16EF180C1F201A8949F75596FC54BB
SHA1:	A99D63F22CAB1C563DB83D1D44C8F56BC6DA4BE3
SHA-256:	D5488D17D72F62C14C20A4549DF6124793E2D924AC43BBFA1CE1BEA96023438B
SHA-512:	70AC65FB303A6EC6CAA6B707B5B95892D15263D01B9E57F17A9379C2EFC0CFAC192B201F401DCAAC989D24096252AF9F2B3448F7F47022EFF6D01F3368D41998
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bcbfd0b8be7349a4864f383978ddefff.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79224uwloON

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.357454175792633
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9QrCJE3nWYFlsjs16:SbFuFyLVIg1BG+f+MyL3nWYF2joa
MD5:	13E56A82CD87A970D3F1D67D6713CC31
SHA1:	103547E831D6E8CDDEB081D9AC398A6E083D1E7F
SHA-256:	3D4F771C0139DF341C4E635FB3586BAA37E3EC3FB75DDD0DCD2D41A749EE0954
SHA-512:	4684542EA4147A0708517BDBF3BC2DCDE75797619D823FF895B490260560951C9F187CE01D778A15F45D5074BE520932FFA7D9F391036B88D716C64AA2983DE3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7721f4537de540ad85d1aa97500cc3bc.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0aJZ7Dm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0x3NQso

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127Dv80Ho

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.349024066544995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgCjTXQY9vW7g206qodgkCj:SbFuFyL3BVgdL87iesnAiRJgO30gt6D6
MD5:	2AEA6118BD698EAA0D59168A2058779F
SHA1:	FEA2487272F4D9ACCD9531D2845884D87964D6CB
SHA-256:	F648B7E8F346EB8FCE9363915935000C637A2590FBD93B4A28DDB5C372B4F99A
SHA-512:	15DE5A5624792015663E8B91BD89CED122FB144AA1EB6F2FB0237A084A81BDA57A6ECA786501FE91C9CA90FB793C5353B2F2A2BD70B3D849137523FF0A97664F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1737645569475201.MONOTONIC=480308319.LAST_SESSION_TIMESTAMP=480441526.

/run/systemd/users/.#127MY9skm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491781095815184
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgO30gt6DCj:qgFq30dABibB3TgAnIDCj
MD5:	64A8DCF1D991BC0A8E807623753C157C
SHA1:	7138A09B92ABCC3856EB60D64C01B82A1FB712C0
SHA-256:	40E4BFE470FF8E6F286637AE24C15BCCE96E04B0D865F9E20B76C5A81A2F25AE
SHA-512:	912F44A6EB60FC764F6035667318D6D8F0A46743FE6E02811ED8E5BB6A526A01DEE7A218C54C036F5F4D078204AA9DE871929832F882EFF238F0DFE72FBABAC2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1737645569475201.MONOTONIC=480308319.LAST_SESSION_TIMESTAMP=480441526.

/run/systemd/users/.#127XtJ1Dp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.315462200983955
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gO3P02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gAPPthQHtPYq9M
MD5:	27E32CA3AC23F2377376816180496A4F
SHA1:	FAD5E120DAF5A61C6D4F275BCBB4FA2CCCD40400
SHA-256:	69E250321D21441702CE360102527C992775C4B473D8EF96FA5BC36FA371D30F
SHA-512:	12E776FEE2C5CBCF2C0A3DF85504DBDA2D46D9A09050FDB210FC6CB8372C4E43B0746D3E656CEC4651D53E603928961C27EC545F385442E62818907198DC308E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1737645569475201.MONOTONIC=480308319.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127cYdqom

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.315462200983955
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gO3P02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gAPPthQHtPYq9M
MD5:	27E32CA3AC23F2377376816180496A4F
SHA1:	FAD5E120DAF5A61C6D4F275BCBB4FA2CCCD40400
SHA-256:	69E250321D21441702CE360102527C992775C4B473D8EF96FA5BC36FA371D30F
SHA-512:	12E776FEE2C5CBCF2C0A3DF85504DBDA2D46D9A09050FDB210FC6CB8372C4E43B0746D3E656CEC4651D53E603928961C27EC545F385442E62818907198DC308E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1737645569475201.MONOTONIC=480308319.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127kxloim

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491781095815184
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgO30gt6DCj:qgFq30dABibB3TgAnIDCj
MD5:	64A8DCF1D991BC0A8E807623753C157C
SHA1:	7138A09B92ABCC3856EB60D64C01B82A1FB712C0
SHA-256:	40E4BFE470FF8E6F286637AE24C15BCCE96E04B0D865F9E20B76C5A81A2F25AE
SHA-512:	912F44A6EB60FC764F6035667318D6D8F0A46743FE6E02811ED8E5BB6A526A01DEE7A218C54C036F5F4D078204AA9DE871929832F882EFF238F0DFE72FBABAC2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1737645569475201.MONOTONIC=480308319.LAST_SESSION_TIMESTAMP=480441526.

/run/systemd/users/.#127xKlzZo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:d/:F
MD5:	86F91758F0D15B0A7542F2428F300580
SHA1:	02534D6B869EFD2A87CADA4ADD2E1FE8F81CF833
SHA-256:	281859AA7F4081E6B3BCC91338CE53C9F22ABA3C63AB523529778323DA80D93A
SHA-512:	2FFB42399916F91587166779B4778BBDCC3EC2C80174E3344B1F5B0ECD273FA83B0C1BBA576E42D130CEBEC72B9C69E188732150B0C2C4919139B0619F50396D
Malicious:	false
Preview:	6332.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.670329327231591
Encrypted:	false
SSDEEP:	3:Vlc1sXlXEWtl/uns:Vlv+ylus
MD5:	C106DADF0FF7D561AD3F888FC7461EBE
SHA1:	3781647EE4007251E36CD6DC5FAD68C4FD06107C
SHA-256:	C84144E0FAE851C333EF3521CC7ECA37C39AC28D7EF1BCECCCB233B0BB8DB297
SHA-512:	042CFA174991F77EBE5B3E31781F7669BE2F1A705C809D00A6F8881DE7FF385A7D09B6A30EE1BF992D402B42826A18E22F6937B63F51FD0A86E0795B6BA50A92
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................].g........................................

/tmp/qemu-open.iBMDNM (deleted)

Download File

Process:	/tmp/Fantazy.sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.5796258815476407
Encrypted:	false
SSDEEP:	6:URN3dDF6EcSSmb/VUMVbsDF6EcSNj/VWL/VDM/V+4D/VH:IldN4JUbENLeMfF
MD5:	3D3E41982A63F45B2BF1E00F60115FF7
SHA1:	D47EFB716D1DE305EA6D99E88117D14B99A7324D
SHA-256:	4E9673EF0B43B0B677339B63EA341AA222BABA79783936F690122B6C9DE39E52
SHA-512:	BBBE546929D3780D4FF0E78DB467559B94BC5AC96C5A6B33187B96DFFC679234EC4EBE9BA65E04B0411326088DDFE484E80F377C241B9B028C0A06BE778D6004
Malicious:	false
Preview:	400000-411000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.sh4.elf.421000-422000 rw-p 00011000 fd:00 531606 /tmp/Fantazy.sh4.elf.422000-423000 rw-p 00000000 00:00 0 .423000-425000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.501C12

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	4.902596676246075
Encrypted:	false
SSDEEP:	24:gqYlZ4ITlZedTLZTvnvGvuwBgAv+gA2+VEol0pYr40Jr4mIv+wrCQU:92vWfVgYr4ar4mIvNrCn
MD5:	D590716B603E923BF68D1A8DDA3651CA
SHA1:	43D8796DECAF141C5386DB7E8DA6E84927F668AC
SHA-256:	6DED2261BFEE0FD66C94E700EE75A8921369076FFBC2C31269209F4C011F3296
SHA-512:	E43084F76FA18A26DF71556727AD9190636840D91D1A0C332B274B334A79C85577F606D3C6BE01A9436CB33A994B16F67915C28E1BCDDD105C8A621E0C724CE9
Malicious:	false
Preview:	Jan 23 09:19:05 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 23 09:19:05 galassia systemd-logind[6337]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 23 09:19:05 galassia systemd-logind[6337]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 23 09:19:05 galassia systemd-logind[6337]: User enumeration failed: Invalid argument.Jan 23 09:19:05 galassia systemd-logind[6337]: User of session c2 not known..Jan 23 09:19:05 galassia systemd-logind[6337]: User of session 2 not known..Jan 23 09:19:05 galassia systemd-logind[6337]: User of session c1 not known..Jan 23 09:19:05 galassia systemd-logind[6337]: Session enumeration failed: No such file or directory.Jan 23 09:19:05 galassia systemd-logind[6337]: Watching system buttons on /dev/input/event0 (Power Button).Jan 23 09:19:05 galassia systemd-logind[6337]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlUdC7qdC7Tt/:F3EA+AV
MD5:	1008E92DB0547BD58899EC87613DBC5E
SHA1:	D32CD53EBCA1C223D13FCE77E52A6BCB8E11E18E
SHA-256:	DA1188A0E569BB0FEDB725C6BC59B88D1BB4044FA1E608AA9E968482D58F2C27
SHA-512:	D4AD92B190F7D2D36408AFFF015A415F4A1BB1B301202C7D9FBA7B623DF7ADD77D5BFB6C2AD29F0DF68B6765E7B2385242965ACC566467268A9DAD526A59F484
Malicious:	false
Preview:	LPKSHHRH................-..j..C8.-\|...ET................................-..j..C8.-\|...ET........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlFslqlVsl6l:F3KeqO
MD5:	EE93FEC41BE3340411FB0FD5D6063B11
SHA1:	A363C11F6BD0FE8135F591661815F1A73C229CFE
SHA-256:	479D5EE1012C7D989598F39567D761128F1A27D9138537A767DAF80D2558EEB0
SHA-512:	BEC22666C91B3B804B6A051614F6AEE700444A9D45DC749E243D7DB5B2E63B26AB043A30F1575A4BF49FA460AEB43ACA19DC50C05C0603A9D0675A1BB90B1864
Malicious:	false
Preview:	LPKSHHRH..................vnw<FF....u..8..................................vnw<FF....u..8........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	11298
Entropy (8bit):	4.990830527356356
Encrypted:	false
SSDEEP:	96:Q93p6U4mziXpbmae4oQuSJ1b/8T1FnDbAmnk+Y1WOr8MWHOr6zYJDYzCuPt2cJsb:gomzeBJKar8pZdv1ldI07U
MD5:	BE5356AD4091C64F8CB4C86D1AE04106
SHA1:	9CF2717A4CB400FAB85418CCCEAD0E66E41C1753
SHA-256:	1013BFA3DB518EA7D7B5A6F313676B777A3B4E47320281CC9F3C4FDC9FC291AD
SHA-512:	8D091F8BABA5035BFF462471D5F51F77C0E29418F04D7FE8E995B5D76A28A9130F51D8949A1A0E07AB624351E6145E0B95C51CA7F50DE7AB81BB632129C70191
Malicious:	false
Preview:	Jan 23 09:19:04 galassia kernel: [ 453.489232] New task spawned: old: (tgid 6331, tid 6331), new (tgid: 6331, tid: 6404).Jan 23 09:19:04 galassia kernel: [ 454.521620] Reached call limit: pid 6263, name read.Jan 23 09:19:04 galassia kernel: [ 455.035384] blocking signal 0: 6263 -> 1809.Jan 23 09:19:04 galassia kernel: [ 455.057435] blocking signal 0: 6263 -> 1860.Jan 23 09:19:04 galassia kernel: [ 455.238186] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6412).Jan 23 09:19:04 galassia kernel: [ 455.239464] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6413).Jan 23 09:19:05 galassia kernel: [ 455.247577] New task spawned: old: (tgid 6405, tid 6412), new (tgid: 6405, tid: 6414).Jan 23 09:19:05 galassia kernel: [ 456.422658] New task spawned: old: (tgid 6415, tid 6415), new (tgid: 6416, tid: 6416).Jan 23 09:19:06 galassia kernel: [ 456.505297] New task spawned: old: (tgid 6416, tid 6416), new (tgid: 6417, tid: 6417).Jan 23 09:19:06 gala

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	36039
Entropy (8bit):	5.078835178160851
Encrypted:	false
SSDEEP:	768:Ygs+FS0efcwC404WibvDtqxlPCpK+UBVOycR1pnEmrHt7Q8WuYU6VjPhVznpuocl:ma3GXzBT
MD5:	E4B6BF620CF237E40BF0517D1C11732A
SHA1:	3B2478ADCC5FB0DC874E33C59FBB0314AA16E285
SHA-256:	16B335B4E68A22790FC9534A59FFF8ED71BC27DED5E919C7A23978F47798BC28
SHA-512:	98228BB894E9A1C4590539D3C62B76ED3D82FD4E123516C907BBC722414766762762AD422BE55894C46F1AB001836BE51DBAF54DEE375EAFF4C47C9C7D1EB4B1
Malicious:	false
Preview:	Jan 23 09:19:03 galassia [2063]: xfce4-panel: Fatal IO error 4 (Interrupted system call) on X server :1..Jan 23 09:19:04 galassia kernel: [ 453.489232] New task spawned: old: (tgid 6331, tid 6331), new (tgid: 6331, tid: 6404).Jan 23 09:19:04 galassia kernel: [ 454.521620] Reached call limit: pid 6263, name read.Jan 23 09:19:04 galassia kernel: [ 455.035384] blocking signal 0: 6263 -> 1809.Jan 23 09:19:04 galassia kernel: [ 455.057435] blocking signal 0: 6263 -> 1860.Jan 23 09:19:04 galassia kernel: [ 455.238186] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6412).Jan 23 09:19:03 galassia [2074]: xfdesktop: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 23 09:19:04 galassia kernel: [ 455.239464] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6413).Jan 23 09:19:03 galassia polkitd[6400]: started daemon version 0.105 using authority implementation `local' version `0.105'.Jan 23 09:19:03 galassia [2079]: wrapper-2.0

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.670329327231591
Encrypted:	false
SSDEEP:	3:Vlc1sXlXEWtl/uns:Vlv+ylus
MD5:	C106DADF0FF7D561AD3F888FC7461EBE
SHA1:	3781647EE4007251E36CD6DC5FAD68C4FD06107C
SHA-256:	C84144E0FAE851C333EF3521CC7ECA37C39AC28D7EF1BCECCCB233B0BB8DB297
SHA-512:	042CFA174991F77EBE5B3E31781F7669BE2F1A705C809D00A6F8881DE7FF385A7D09B6A30EE1BF992D402B42826A18E22F6937B63F51FD0A86E0795B6BA50A92
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................].g........................................

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.696707105396504
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.sh4.elf
File size:	70'648 bytes
MD5:	7840f7652446ba21a0d3d8f544843ddf
SHA1:	f2e59105ff9cfab228908dd42a2ca00b27097a3b
SHA256:	06127ddfad660b641bbbbb3a1c8ab143be91bcce4aebafb6af071b61dfa7d8cc
SHA512:	fcc4074f33c86ab86d03df581de64696f121d7b66064a842c0668f3f5efbae28e1a53f787df14a7b5a3e6890b9170537e54b0e275dc09e28f7aa12a7f98ae565
SSDEEP:	1536:n/THhka1wt+nxjYraYtfNSmJemJjQQjSY2LC0Ly:nbH+Grx0rnv9emHjSY2LJy
TLSH:	61638D76D578ACA0C04889B576A8D9B44703A804A6F77EF1CAC19F59080BEFCF1497F6
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@...........................B...B.(...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70248
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xf600	0x0	0x6	AX	32
.fini	PROGBITS	0x40f6e0	0xf6e0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f704	0xf704	0x1294	0x0	0x2	A	4
.ctors	PROGBITS	0x421000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x421008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x421014	0x11014	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x421228	0x11228	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11228	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10998	0x10998	6.8211	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x421000	0x421000	0x228	0x780	3.0141	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2025 16:19:03.331671953 CET	192.168.2.23	1.1.1.1	0xc94d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2025 16:19:03.331744909 CET	192.168.2.23	1.1.1.1	0x19d6	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 23, 2025 16:19:03.822909117 CET	192.168.2.23	1.1.1.1	0x1d53	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2025 16:19:03.354269981 CET	1.1.1.1	192.168.2.23	0xc94d	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 23, 2025 16:19:03.354269981 CET	1.1.1.1	192.168.2.23	0xc94d	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-23 15:19:09 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-23 15:19:10 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-23 15:19:10 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-23 15:19:10 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Jan 2025 15:19:10 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	15:18:23
Start date (UTC):	23/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:18:32
Start date (UTC):	23/01/2025
Path:	/tmp/Fantazy.sh4.elf
Arguments:	/tmp/Fantazy.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	15:18:39
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:18:43
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:18:58
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:18:59
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:01
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:02
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:03
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:04
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:05
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:06
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:19:07
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6479/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:74658GHCiVL

/run/systemd/journal/streams/.#9:74660RyKxvN

/run/systemd/journal/streams/.#9:756386QqaRK

/run/systemd/journal/streams/.#9:75650fzmDFK

/run/systemd/journal/streams/.#9:76050FcDFEM

/run/systemd/journal/streams/.#9:76847VhLxcK

/run/systemd/journal/streams/.#9:76848OmgViK

/run/systemd/journal/streams/.#9:76862eSELIK

/run/systemd/journal/streams/.#9:77027hRcrIL

/run/systemd/journal/streams/.#9:77069ZY5NnN

/run/systemd/journal/streams/.#9:771707V731K

/run/systemd/journal/streams/.#9:77187WfCTSN

/run/systemd/journal/streams/.#9:774396nV6eM

/run/systemd/journal/streams/.#9:77466u912lO

/run/systemd/journal/streams/.#9:781590OCkOK

/run/systemd/journal/streams/.#9:78161ebfYfN

/run/systemd/journal/streams/.#9:78197pzfZVN

/run/systemd/journal/streams/.#9:78199Dn9MlL

/run/systemd/journal/streams/.#9:79224uwloON

/run/systemd/seats/.#seat0aJZ7Dm

/run/systemd/seats/.#seat0x3NQso

/run/systemd/users/.#127Dv80Ho

/run/systemd/users/.#127MY9skm

/run/systemd/users/.#127XtJ1Dp

/run/systemd/users/.#127cYdqom

/run/systemd/users/.#127kxloim

/run/systemd/users/.#127xKlzZo

/run/user/1000/pulse/pid

Linux Analysis Report
Fantazy.sh4.elf

Start time (UTC):	15:19:08
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:19:09
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:19:11
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:15
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:25
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:19:27
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:19:29
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	15:19:30
Start date (UTC):	23/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --print-address 3 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:19:31
Start date (UTC):	23/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	15:19:42
Start date (UTC):	23/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933