Create Interactive Tour

Linux Analysis Report
Fantazy.arm4.elf

Overview

General Information

Sample name:	Fantazy.arm4.elf
Analysis ID:	1601268
MD5:	0c9b710b7faa928572afe6b73508ed6d
SHA1:	4c26c1a50facc47199b4daed93e781f5aaa43536
SHA256:	b51519d665a607995cd0b46c241b8f10a038bf2d71ff52d35f083caf2db7c8eb
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1601268
Start date and time:	2025-01-28 13:19:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.arm4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.arm4.elf
PID:	6209
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6189, Parent: 4331)

rm (PID: 6189, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.370zRLRiR2 /tmp/tmp.LlYZe06V1E /tmp/tmp.p9zaamO9T7

dash New Fork (PID: 6190, Parent: 4331)

rm (PID: 6190, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.370zRLRiR2 /tmp/tmp.LlYZe06V1E /tmp/tmp.p9zaamO9T7

Fantazy.arm4.elf (PID: 6209, Parent: 6124, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Fantazy.arm4.elf

Fantazy.arm4.elf New Fork (PID: 6211, Parent: 6209)

Fantazy.arm4.elf New Fork (PID: 6212, Parent: 6209)

Fantazy.arm4.elf New Fork (PID: 6215, Parent: 6212)

Fantazy.arm4.elf New Fork (PID: 6217, Parent: 6212)

Fantazy.arm4.elf New Fork (PID: 6219, Parent: 6212)

systemd New Fork (PID: 6227, Parent: 1)

journalctl (PID: 6227, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6240, Parent: 1)

systemd-journald (PID: 6240, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6243, Parent: 1)

journalctl (PID: 6243, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6298, Parent: 1)

dbus-daemon (PID: 6298, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6311, Parent: 1860)

pulseaudio (PID: 6311, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6314, Parent: 1)

rtkit-daemon (PID: 6314, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6317, Parent: 1)

systemd-logind (PID: 6317, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6379, Parent: 1)

polkitd (PID: 6379, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6384, Parent: 1)

agetty (PID: 6384, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6385, Parent: 1320)

Default (PID: 6385, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6386, Parent: 1320)

Default (PID: 6386, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6387, Parent: 1)

rsyslogd (PID: 6387, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6388, Parent: 1320)

Default (PID: 6388, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6394, Parent: 1)

gpu-manager (PID: 6394, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6395, Parent: 6394)

sh (PID: 6395, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6396, Parent: 6395)

grep (PID: 6396, Parent: 6395, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6397, Parent: 6394)

sh (PID: 6397, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6398, Parent: 6397)

grep (PID: 6398, Parent: 6397, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6399, Parent: 6394)

sh (PID: 6399, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6401, Parent: 6394)

sh (PID: 6401, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6402, Parent: 6401)

grep (PID: 6402, Parent: 6401, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6403, Parent: 6394)

sh (PID: 6403, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6404, Parent: 6403)

grep (PID: 6404, Parent: 6403, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6405, Parent: 6394)

sh (PID: 6405, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6408, Parent: 6394)

sh (PID: 6408, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6408)

grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6410, Parent: 6394)

sh (PID: 6410, Parent: 6394, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6410)

grep (PID: 6412, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6426, Parent: 1)

generate-config (PID: 6426, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6432, Parent: 6426)

pkill (PID: 6432, Parent: 6426, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6433, Parent: 1)

gdm-wait-for-drm (PID: 6433, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6438, Parent: 1)

gdm3 (PID: 6438, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6442, Parent: 6438)

plymouth (PID: 6442, Parent: 6438, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6462, Parent: 6438)

gdm-session-worker (PID: 6462, Parent: 6438, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6466, Parent: 6462)

gdm-wayland-session (PID: 6466, Parent: 6462, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6468, Parent: 6466)

dbus-daemon (PID: 6468, Parent: 6466, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6470, Parent: 6468)

dbus-daemon New Fork (PID: 6471, Parent: 6470)

false (PID: 6471, Parent: 6470, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6472, Parent: 6466)

dbus-run-session (PID: 6472, Parent: 6466, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6473, Parent: 6472)

dbus-daemon (PID: 6473, Parent: 6472, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6474, Parent: 6438)

Default (PID: 6474, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6475, Parent: 6438)

Default (PID: 6475, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6444, Parent: 1)

accounts-daemon (PID: 6444, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6455, Parent: 6444)

language-validate (PID: 6455, Parent: 6444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6456, Parent: 6455)

language-options (PID: 6456, Parent: 6455, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6457, Parent: 6456)

sh (PID: 6457, Parent: 6456, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6458, Parent: 6457)

locale (PID: 6458, Parent: 6457, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6459, Parent: 6457)

grep (PID: 6459, Parent: 6457, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6485, Parent: 2038)

fusermount (PID: 6485, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6527, Parent: 1860)

dbus-daemon (PID: 6527, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6387)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6209)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6438)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 104.232.180.23
Source: unknown	TCP traffic detected without corresponding DNS query: 5.244.98.161
Source: unknown	TCP traffic detected without corresponding DNS query: 43.47.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 74.94.151.154
Source: unknown	TCP traffic detected without corresponding DNS query: 157.201.1.31
Source: unknown	TCP traffic detected without corresponding DNS query: 196.113.102.165
Source: unknown	TCP traffic detected without corresponding DNS query: 37.119.25.143
Source: unknown	TCP traffic detected without corresponding DNS query: 81.36.153.196
Source: unknown	TCP traffic detected without corresponding DNS query: 72.26.55.162
Source: unknown	TCP traffic detected without corresponding DNS query: 202.87.111.193
Source: unknown	TCP traffic detected without corresponding DNS query: 165.66.245.162
Source: unknown	TCP traffic detected without corresponding DNS query: 106.174.38.21
Source: unknown	TCP traffic detected without corresponding DNS query: 151.4.238.80
Source: unknown	TCP traffic detected without corresponding DNS query: 1.226.134.122
Source: unknown	TCP traffic detected without corresponding DNS query: 81.0.6.69
Source: unknown	TCP traffic detected without corresponding DNS query: 145.47.186.211
Source: unknown	TCP traffic detected without corresponding DNS query: 202.11.123.94
Source: unknown	TCP traffic detected without corresponding DNS query: 27.18.208.71
Source: unknown	TCP traffic detected without corresponding DNS query: 37.80.250.91
Source: unknown	TCP traffic detected without corresponding DNS query: 72.180.59.88
Source: unknown	TCP traffic detected without corresponding DNS query: 81.17.122.158
Source: unknown	TCP traffic detected without corresponding DNS query: 44.169.111.248
Source: unknown	TCP traffic detected without corresponding DNS query: 154.29.225.170
Source: unknown	TCP traffic detected without corresponding DNS query: 104.253.54.71
Source: unknown	TCP traffic detected without corresponding DNS query: 14.254.60.96
Source: unknown	TCP traffic detected without corresponding DNS query: 46.117.56.155
Source: unknown	TCP traffic detected without corresponding DNS query: 46.205.122.70
Source: unknown	TCP traffic detected without corresponding DNS query: 192.170.136.38
Source: unknown	TCP traffic detected without corresponding DNS query: 192.132.149.221
Source: unknown	TCP traffic detected without corresponding DNS query: 154.78.49.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.21.222.100
Source: unknown	TCP traffic detected without corresponding DNS query: 31.40.92.236
Source: unknown	TCP traffic detected without corresponding DNS query: 123.194.150.161
Source: unknown	TCP traffic detected without corresponding DNS query: 141.3.1.207
Source: unknown	TCP traffic detected without corresponding DNS query: 34.68.255.237
Source: unknown	TCP traffic detected without corresponding DNS query: 104.34.78.110
Source: unknown	TCP traffic detected without corresponding DNS query: 218.6.29.122
Source: unknown	TCP traffic detected without corresponding DNS query: 114.91.157.175
Source: unknown	TCP traffic detected without corresponding DNS query: 123.82.49.244
Source: unknown	TCP traffic detected without corresponding DNS query: 39.67.166.58
Source: unknown	TCP traffic detected without corresponding DNS query: 4.6.194.161
Source: unknown	TCP traffic detected without corresponding DNS query: 93.212.57.149
Source: unknown	TCP traffic detected without corresponding DNS query: 114.49.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 168.231.40.146
Source: unknown	TCP traffic detected without corresponding DNS query: 72.100.75.207
Source: unknown	TCP traffic detected without corresponding DNS query: 163.178.227.182
Source: unknown	TCP traffic detected without corresponding DNS query: 217.127.204.10

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.47.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6183, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6217, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6183, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6217)	SIGKILL sent: pid: 6217, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6298)	File: /proc/6298/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	File: /proc/6468/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6473)	File: /proc/6473/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6485)	File: /proc/6485/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6527)	File: /proc/6527/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:75831Ai9hf0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:75836o79G30	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:75482E1yzT3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:76066npluk0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:76084GZvHk0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:76088rZnIM1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:75649F8EqE1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:75775OIgUJ1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:768014ldyx1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:76916j8iPL3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77051cynQ82	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77291XRVSn1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77293EGHdc1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77437DeI4Q2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77837pAsnS0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77730ZMTbo4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:778911InQP0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77892aJsrW0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:779140KB8D4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:77915MluVs1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:79434aq4Uj0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/seats/.#seat0RqiDJR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/users/.#127smMiiQ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/users/.#127zyfUoT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/seats/.#seat0WCyezR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/users/.#1273Isz0S	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/users/.#127ObN3HS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6317)	File: /run/systemd/users/.#127Akyx6R	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6379)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6466)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/6311/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1576/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	File opened: /proc/2025/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6395)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6397)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6401)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6403)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6457)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6396)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6398)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6402)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6404)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6459)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6432)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6189)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.370zRLRiR2 /tmp/tmp.LlYZe06V1E /tmp/tmp.p9zaamO9T7			Jump to behavior
Source: /usr/bin/dash (PID: 6190)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.370zRLRiR2 /tmp/tmp.LlYZe06V1E /tmp/tmp.p9zaamO9T7			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6240)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6384)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6438)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6438)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6394)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6394)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6209)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6240)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6311)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6384)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6394)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6462)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.arm4.elf, 6209.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6211.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6212.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6215.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6217.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Fantazy.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.arm4.elf
Source: Fantazy.arm4.elf, 6217.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.3VJgFi
Source: Fantazy.arm4.elf, 6209.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6211.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6212.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6215.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6217.1.000055f47773b000.000055f477869000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6209.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6211.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6212.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6215.1.000055f47773b000.000055f477869000.rw-.sdmp, Fantazy.arm4.elf, 6217.1.000055f47773b000.000055f477869000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6217.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.3VJgFi
Source: Fantazy.arm4.elf, 6209.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6211.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6212.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6215.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp, Fantazy.arm4.elf, 6217.1.00007ffcb8ca2000.00007ffcb8cc3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.arm4.elf	56%	Virustotal		Browse
Fantazy.arm4.elf	68%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.arm4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.47.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.198.40.121	unknown	Slovenia	5603	SIOL-NETTelekomSlovenijeddSI	false
181.255.46.139	unknown	Colombia	26611	COMCELSACO	false
53.52.244.8	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
186.163.225.38	unknown	Peru	21575	ENTELPERUSAPE	false
43.201.20.66	unknown	Japan	4249	LILLY-ASUS	false
120.121.110.177	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
17.22.98.112	unknown	United States	714	APPLE-ENGINEERINGUS	false
63.143.96.106	unknown	Jamaica	33576	DIG001JM	false
166.147.33.31	unknown	United States	6167	CELLCO-PARTUS	false
38.146.8.182	unknown	United States	174	COGENT-174US	false
177.47.40.63	unknown	Brazil	28652	TelecomunicacoesNordesteLtdaBR	false
5.97.34.19	unknown	Italy	3269	ASN-IBSNAZIT	false
204.83.147.129	unknown	Canada	803	SASKTELCA	false
154.173.91.33	unknown	Ghana	30986	SCANCOMGH	false
149.37.252.47	unknown	United States	62240	CLOUVIDERClouvider-GlobalASNGB	false
149.74.224.210	unknown	United States	12479	UNI2-ASES	false
213.41.59.77	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
140.226.107.157	unknown	United States	16519	CUDENVERUS	false
53.32.132.191	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
90.67.176.241	unknown	France	3215	FranceTelecom-OrangeFR	false
66.252.67.10	unknown	United States	12223	AS-EQUIVOICE-COMUS	false
99.7.56.3	unknown	United States	7018	ATT-INTERNET4US	false
197.10.101.68	unknown	Tunisia	5438	ATI-TN	false
165.151.49.234	unknown	United States	4193	WA-STATE-GOVUS	false
191.233.184.243	unknown	Brazil	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
122.206.16.10	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
198.107.254.249	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
37.202.175.98	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
149.44.216.88	unknown	United States	174	COGENT-174US	false
88.205.147.8	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
155.248.49.4	unknown	United States	6142	SUN-JAVAUS	false
59.86.173.172	unknown	Australia	38333	SYMBIO-AS-AU-APSymbioNetworksAU	false
126.95.198.167	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
27.40.232.240	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
197.33.61.236	unknown	Egypt	8452	TE-ASTE-ASEG	false
92.12.56.78	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
153.89.245.47	unknown	United States	158	ERI-ASUS	false
193.195.116.175	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
1.5.190.71	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
221.121.54.87	unknown	Viet Nam	7602	SPT-AS-VNSaigonPostelCorporationVN	false
110.62.196.140	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
203.99.100.167	unknown	Indonesia	10137	PATRANET-APPatrakomInternetServiceProviderID	false
135.59.139.160	unknown	United States	18676	AVAYAUS	false
160.188.108.8	unknown	Japan	36903	MT-MPLSMA	false
100.246.40.105	unknown	United States	21928	T-MOBILE-AS21928US	false
123.104.171.184	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
170.241.236.76	unknown	United States	11685	HNBCOL-ASUS	false
208.149.112.190	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
69.129.40.87	unknown	United States	4181	TDS-ASUS	false
71.35.102.157	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
1.255.4.125	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
94.112.89.120	unknown	Czech Republic	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
213.34.148.210	unknown	Netherlands	33915	TNF-ASNL	false
38.159.247.175	unknown	United States	174	COGENT-174US	false
223.161.24.122	unknown	China	7641	CHINABTNChinaBroadcastingTVNetCN	false
124.243.95.132	unknown	Korea Republic of	9842	LDCC-ASLotteDataCommunicationCompanyKR	false
2.149.113.66	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
8.182.118.63	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
31.194.183.237	unknown	Italy	3269	ASN-IBSNAZIT	false
124.248.62.13	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
71.81.11.56	unknown	United States	20115	CHARTER-20115US	false
110.96.41.163	unknown	China	24138	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
23.232.250.240	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
18.237.164.111	unknown	United States	16509	AMAZON-02US	false
69.114.176.252	unknown	United States	6128	CABLE-NET-1US	false
45.13.78.88	unknown	United Kingdom	208784	ASTLRKUS	false
196.81.190.55	unknown	Morocco	6713	IAM-ASMA	false
190.234.240.17	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
58.175.107.251	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
46.247.116.166	unknown	United Kingdom	39545	FLUIDATAGB	false
196.152.102.4	unknown	Egypt	36935	Vodafone-EG	false
175.190.238.212	unknown	China	2510	INFOWEBFUJITSULIMITEDJP	false
176.77.59.59	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
218.154.146.153	unknown	Korea Republic of	18023	KMU-AS-KRKoreaMaritimeandOceanUniversityKR	false
186.120.219.253	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
112.4.206.133	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
86.23.202.175	unknown	United Kingdom	5089	NTLGB	false
221.177.78.86	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
13.124.42.54	unknown	United States	16509	AMAZON-02US	false
111.218.31.79	unknown	Korea Republic of	18302	SKG_NW-AS-KRSKTelecomKR	false
44.227.217.60	unknown	United States	16509	AMAZON-02US	false
168.245.211.175	unknown	United States	395772	AHC-ASUS	false
183.105.179.66	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
18.174.113.42	unknown	United States	3	MIT-GATEWAYSUS	false
98.201.244.157	unknown	United States	7922	COMCAST-7922US	false
155.108.231.235	unknown	United States	1906	NORTHROP-GRUMMANUS	false
222.8.48.211	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
170.95.165.88	unknown	unknown	21852	DISNW1US	false
187.95.25.16	unknown	Brazil	53081	NetjacareiTeleconLtdaBR	false
12.141.220.43	unknown	United States	7018	ATT-INTERNET4US	false
36.169.232.106	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
197.76.213.179	unknown	South Africa	16637	MTNNS-ASZA	false
4.22.230.192	unknown	United States	3356	LEVEL3US	false
88.106.253.168	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
210.149.66.13	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
88.107.107.186	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
41.48.216.123	unknown	South Africa	37168	CELL-CZA	false
209.202.156.189	unknown	United States	27475	WAYFAIR-ASNUS	false
165.0.11.52	unknown	South Africa	37053	RSAWEB-ASZA	false
170.134.138.247	unknown	United States	23148	TERRENAPUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
99.7.56.3	IdR7xl9k9N	Get hash	malicious	Mirai	Browse
120.121.110.177	arm7-20230722-0756.elf	Get hash	malicious	Mirai	Browse
154.173.91.33	nag.mips.elf	Get hash	malicious	Mirai	Browse
181.255.46.139	boat.arm7-20220930-1611.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Mirai	Browse
	home.x86_64	Get hash	malicious	Mirai	Browse
	home.arm7-20220726-0916	Get hash	malicious	Mirai	Browse
	m4g8X8sAZy	Get hash	malicious	Mirai	Browse
	WGtekY8sL8	Get hash	malicious	Mirai	Browse
	JuHhSTMOBq	Get hash	malicious	Mirai	Browse
	yJOZ3EeESV	Get hash	malicious	Unknown	Browse
213.41.59.77	notabotnet.i686.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	networkrip.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	networkrip.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIOL-NETTelekomSlovenijeddSI	wanna.mpsl.elf	Get hash	malicious	Mirai	Browse	188.197.198.9
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	188.199.17.72
	ewe.x86.elf	Get hash	malicious	Mirai	Browse	89.143.159.106
	armv6l.elf	Get hash	malicious	Unknown	Browse	188.199.197.65
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	89.143.159.101
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	188.199.54.54
	hsmSW6Eifl.dll	Get hash	malicious	Wannacry	Browse	193.95.220.19
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	185.58.180.65
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	185.58.180.76
	3.elf	Get hash	malicious	Unknown	Browse	188.198.186.178
COMCELSACO	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	181.155.228.106
	wanna.mpsl.elf	Get hash	malicious	Mirai	Browse	181.155.193.65
	wanna.arm.elf	Get hash	malicious	Mirai	Browse	181.255.145.164
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	181.154.103.250
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	190.126.126.199
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	191.69.208.116
	g4za.x86.elf	Get hash	malicious	Unknown	Browse	191.154.8.1
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	191.68.58.193
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	181.255.203.45
	z3hir.arm	Get hash	malicious	Mirai	Browse	191.79.121.111
DAIMLER-ASITIGNGlobalNetworkDE	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	53.239.229.250
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	53.165.58.245
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	53.28.37.216
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	53.253.10.219
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	53.152.2.99
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	53.238.124.5
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	53.146.70.242
	wanna.arm7.elf	Get hash	malicious	Mirai	Browse	53.68.172.57
	wanna.spc.elf	Get hash	malicious	Mirai	Browse	53.28.44.204
	sora.mips.elf	Get hash	malicious	Mirai	Browse	53.213.231.28
ENTELPERUSAPE	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	186.164.127.220
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	186.163.201.47
	mpsl.elf	Get hash	malicious	Unknown	Browse	132.184.189.202
	QQE81XYXon.dll	Get hash	malicious	Wannacry	Browse	186.162.98.9
	sLlAsC4I5r.dll	Get hash	malicious	Wannacry	Browse	132.251.70.33
	1.elf	Get hash	malicious	Unknown	Browse	132.157.173.58
	armv7l.elf	Get hash	malicious	Unknown	Browse	186.160.244.161
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	132.191.227.10
	nabx86.elf	Get hash	malicious	Unknown	Browse	132.184.251.175
	arm.elf	Get hash	malicious	Unknown	Browse	132.184.214.56

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.monitor.

/proc/6471/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Gn:G
MD5:	22531F93A726E95D55BDED84CD850CBE
SHA1:	61D6AE2C76338BFD9441B5D241FB45C54CA4F89B
SHA-256:	137B75277977D1EB9015A2A89300A93442F36B1433B9A69BE7977274D5FD0CDA
SHA-512:	0058BB6B420980CACC754F12588DC37D6ECF6CD7D7A6AB9198F5C02FDEC34CB908358ACA05DBF9168C1289367375FDDC8E474A0C8626795E3F30412A0284C212
Malicious:	false
Reputation:	low
Preview:	6438.

/run/systemd/journal/streams/.#9:75482E1yzT3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.422615940375814
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsApRGEzSWWUXCpSLK:SbFuFyLVIg1BG+f+Ms0TFLeZjosQu
MD5:	6DC474F3CD08B83F54E5D80AB0719284
SHA1:	58691F2EB0D57F89D24D26F34880FE11AE8DFCDB
SHA-256:	4C3C61E662E065EA1974ECA1BEAD1D0E099EF9D026A1F95F6A1ED98127E86B0C
SHA-512:	8193255314F697662CFAE8A71E3C406A13511C085B620ADEDF0D67A690B5FEA09E45E93B8237D0715CBCEADEFAA15EC85D9B7C5F353B12C0A4F15CCAEB139F23
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe0f4ffae5c640738112c0882f8784b8.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75649F8EqE1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.339618187329116
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzaBySLDXzGGORDRA4:SbFuFyLVIg1BG+f+MGyq9OlR8sZjtWL0
MD5:	608D3E6D429E23DA6EC065851024FABA
SHA1:	B481E0D077D0784BDD6CCAC1A602C1B231F1CBFD
SHA-256:	185894606CF20604598484C0C57475BFD478DCEA60AC66AC75D2257469A118A9
SHA-512:	91A51B2389F35AAA22EA85F56507E8A34CB88E1BBF6955845236C2BAFF318010103C5C4BC642FE1AD84989729D664CAF877819AF976E40B6D7935F6234B83B8E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ed78adda77348d285eccdfa4f4c4260.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:75775OIgUJ1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4304201487733295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuvVelrWUKUJsZjsjF:SbFuFyLVIg1BG+f+MuvVeZGZjNE
MD5:	B573195E37697AFE1D41E584400CE2E8
SHA1:	1FEEBD41E872CF38C7DF8B080A768A185C273E38
SHA-256:	28327945837AC6C08858093FFC48840A83D8310653E8E9B452ACC9A9DCE4F7C7
SHA-512:	D9FB01AC9B9F517E716960C95F64044D368A58096D2238E5FEB82A58AECC5005A979F915D3452AC98957AFDDF4934D8761ED27D74311E4F98CDB84D8CB18E05A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da6a067822b6494aa5a631fe45189014.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:75831Ai9hf0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.502829216400096
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6zpdaDAc+bsh+sjsv:SbFuFyLVIg1BG+f+M6Vda7+IhTji4s
MD5:	4AEC43029421C1F29CBE28269F29D845
SHA1:	94D45A497FB47008D1F9A383B667E76ED0C446DD
SHA-256:	2B71C6BDC89D7A5121FFF77055AD6E69435FE38B3D7D12F2B971F5D64E823903
SHA-512:	A6742881E8F25AB2B0ACAC959FDC439F9BFB1D8DE53F9CC9188EF8B935D00CB1B6950597FCF0F9A22E74ACE8A3B6918306053125B22BB6925927BC33AA6074DE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e36029e7a474b539302f3fe7d844000.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75836o79G30

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5012663664198405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5NAwTksQHF0sjs7LH:SbFuFyLVIg1BG+f+MfAES7ji4s
MD5:	E69F0CD07DCC196A27B5FF3CB33473CB
SHA1:	714B284285DBCD3B00572B0D1257014FF5C230BF
SHA-256:	CFEF1D432AA4EB457C424EA3C485672A013383080EA1523CD6DFAB5E80FD1837
SHA-512:	C1AF3F243188FE1052BA921F48A12520CE6164A03B56F99A4967755C99A58275DF07FAB136BD0F0A8B9B15B3C40E309B9544D5ED1E1BE6A9B63320B7B24343BB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39081ef8c67f4af783beaa6e4ab8b96b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76066npluk0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.391818306597913
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7W/S7Fq21SVETkrsS:SbFuFyLVIg1BG+f+MZZXdBjdCLKzK
MD5:	5F8EDE2C4465F94E9E190FAC3F93FF2E
SHA1:	E665F0E74326A1010E4042DA49258C2DB4BC0A8A
SHA-256:	3E1FD1A48F3BA20CC49F685248EB3F65C677C7829E565ECFD179BD8C5D9DEEC5
SHA-512:	082753D47FE50C1EB0C121395CD1A6652F1E53DB3C7DEBE56ACEA45EC3DA73CFF75FC9DECFA2E1BA4B571D26925F271635CC1CEEA9DC2789BFE68D18EF68817C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1fc80079b9204d708e6d93b70a63c753.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76084GZvHk0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.42647679534402
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mu9wJDgrqjFmzXvn:qgFqo6g7/+0+f+MaEQXvn
MD5:	4AE935AAB5FC1742F63BEB9BE2969CED
SHA1:	6C69EFD1F476A18F65FF2F4AFE72DBE29222C8F9
SHA-256:	80DACBE8D499EAFF85E91C2B7150B005621740CCB06E6A586500FC26712FF315
SHA-512:	9090A3DB8FCB6C88433C3A17F180629AC82C037850C40AC3728C8B8CDD8099E2968DCD95C9920272F206D95C859090118BB8CAE053D1E72DED813E5B9C40B939
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de73889439bc4cf9b0e9fa86164fcada.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76088rZnIM1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.45946179805357
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9BJhoxPTdo+sjsn:SbFuFyLVI6g7/+BG+f+MVyxiTjFmzXvn
MD5:	B78D67B9C8728E3572BF65FE0F9D99C8
SHA1:	4006C128A00E0849A6F99ACAD1483E4DE6E93998
SHA-256:	1B18BF9C55A8498F869374AF40D987B974DD5997058D8CB92D9845910A4B89CA
SHA-512:	6C214D576728C0E28E2E9608870949E38AB2F7AB1B65F1AEE18631939ACD9D77391D081AB46756A4A14BC3CEB3D25A364D5B187E40C418ED63829125CDAC01AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=794a593cd4da4167b212428a23f5d682.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:768014ldyx1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.504617851993415
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+KW1hg2jZcHcljX+:qgFq6g10+f+MohgYmAu
MD5:	FE686E633A6E29F9F5BEA71A7273C7F3
SHA1:	1806FF93E9A34C3EEF794948DD6DA49E734F6ECD
SHA-256:	B57DA1CB1EFB0D57F3A362A377DBA35F5D1C33A80A367C17885A6EBB6DB2326B
SHA-512:	C39FAFFD3AF01929B32C2FBA6B309415269BBCBC98CCECDCB7C537CDB7C3D35045600036D8E8AACC9D6745B03E12F8F272C7361A1D246EF5EF9E1CE9899F0D96
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4056bd7bf64a45828a795140898340b8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76916j8iPL3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3927186944838725
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvSQTT4CSsjshKJvel:SbFuFyLVIg1BG+f+MxTT5fjbVC
MD5:	64EE08D344B6DDA8DAA11CAE75FB3D57
SHA1:	FF82C5231600F6AE9971B2298321A5B2928A0D61
SHA-256:	14E31F570EF2A63E16FF8F9D82F58A29B83A74DECCD01FEAFEEC91A039DFF4A4
SHA-512:	E9A817618796808D1885ECE344D3968690ABBA140CCB0E3CE990F22BF7A81D78101809E88C01E331273FE89975CD15D07308C620E279263D3E5BF5CD47E21F7A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e6574ed69ca84ba4ad2481dce922d82c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77051cynQ82

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.43398609473814
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6L3TyeGHUUR2d7gr/:SbFuFyLVIg1BG+f+M6LjyA2rqjLkGq
MD5:	5F4BB45FBF1628FBE88EEFA3106BB49D
SHA1:	960512E968633A2AB229E3A5355BFE8DC95290D9
SHA-256:	C0A5D0DFE07352FD34F6C8828D18C362375B734E3FE73CE21A12F431370F5951
SHA-512:	1109B2DA113BC04B73BA43853587B5AD780AFA12DD68C562BEFF4FA871CD82B8B2BD59E1C794557D5E85779F4BB980A9C704580F72CEE1E1C478FBB943218518
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03b05424d6b7461cb16597fea33e68fc.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77291XRVSn1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.426496825359082
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm59TB5TSoGAgrxsjsh:SbFuFyLVIg1BG+f+MjfOrqjdCt/rRMtq
MD5:	0B0CAA51487B0B63B97625C65A471815
SHA1:	6975B366C840269FEBA7126C2C0066F95D3F7C59
SHA-256:	8EC8036BA2956680C4EAA3139F5637A08E658748F0DCD71957F651922840FD1D
SHA-512:	DEDE48C784122B7791E114E30E4F454F49E42DB44A72EA46164F3727FBB85D4ADEF882510604C5CACFD6DF44E2BB32400D710AFD51C00CE716A8F69CE2DE2747
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b68fb6dadcb42138a7ae0d4f1e7c6da.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77293EGHdc1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.411406217384831
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuPyhEQB0MqjNALyAZD:qgFq6g1af+Mwk0MwIZD
MD5:	9326F96479147F424EE66A111DF7C1A3
SHA1:	6895FFFEFA0D5ED036F0244FC07073616A9B4CFD
SHA-256:	F1745D52ECE758A6E5B7F8AB95473444990E01F61372D0425D3E034F0EEF105F
SHA-512:	C294B468BB0B03C6547B0212A2E5132BD1FCA02B6353F3F7AF46D1A0B5A594ECE15946B0033CAA6763CB7D725BC8BF7FA93B90C137D05D83E26970FBB3E29A76
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d9c944827bea41d2a9fa25a401f4ae75.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77437DeI4Q2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.435349809223344
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6sbCeHBHA2rEYIjs2BI:SbFuFyLVIg1BAf+M6s2MxADjNdQIeXD
MD5:	BE8FD841D5940440F5E5D9C80734CE53
SHA1:	75C36529BC69EA3AA98F6AB2170CE44B4CA191CA
SHA-256:	9D18FA4815E3A80FC2CEC3AB211A09AC99FBB0AA5F3A25E16DF494C40208ABE7
SHA-512:	E7D11E4486821711A6AA5372B2613AABA596223AB8D4D174E8C8963044687EA9EC2563D6541D18CA1CCFEED6348C2F502B65F6C4C608FBFD44BAA2B337D8F2CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d708cd9c0894b4db3b84717dd8a0496.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77730ZMTbo4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.412059066634459
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuMXgoC3C2jLTTIWTIL:qgFq6g10+f+MG9EWEL
MD5:	C29F1B3926062138E24B4D86EEB8C43F
SHA1:	15E5B98AA5DD214DFF459F1554A4280A4F3F5C57
SHA-256:	CA91C97CCF994D20DFC305034206A6ECD3BD0E0DE6F1ADF91ED9B5E054202DFE
SHA-512:	691971700511E366B6A4E35261EFAA5B820453937E97235669D1B2BA5EB01E231A0C93E2032FBDD579A0CAD4CFD0BD9F8CA78B45978193A6C3D508D8023B868F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d01b34fa27fa44c8a6f47c9ebbaf8d0c.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77837pAsnS0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.395261803823756
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+R3XHTBEDVEBoflKFrI:SbFuFyLVIg1BAf+M+RWD4EGrqjNTZD
MD5:	FE9E334D63A72E0080B873E8AD8D3642
SHA1:	AC703E9868CE4498C52C5DC817D01841FFD51F57
SHA-256:	F1BCBEAD6C0E61A514D1960ABC0C2D203BB6E62E0C95A3B73008707C9C4FFBBE
SHA-512:	653AF54EB9FAA992052D41B9441BB1D63131C970038FF3B1C5DE45DF4254B2689FBE62637A5680EEA9B72A8A2B395EF8EC77F440A8F9275C203B79F3BC9E9D5B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d08b082b62b4af0a3cbaf598824110e.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:778911InQP0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.389487152396832
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmv1cQADdUR57A1Ec:SbFuFyLVK6g7/+BG+f+MuQADWR1uqjNq
MD5:	FDA3FC7352909EFF84F6EB7BD1B52BFE
SHA1:	54FFFCC8CA2E57F998377740DC7E43BA3B625DFB
SHA-256:	9F40A92031E6006DD4BC87FEAC7C4EAB81D3FEF8DFAE771A0CB3EADDB6DC9915
SHA-512:	4E348EA4D445C14E3CE7DA221740954A74B5493520509FEC288745CEF02CBA87B1200389DB457642FA52E248045ACF71BC84C51E397F7D97542FD0ABD68C6EAA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9a9bdcec18148a5af4f148e3fcba1ac.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77892aJsrW0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4194467064468155
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6ufskyQdweATjNq:qgFqdg7/+0+f+Mx/DzAFq
MD5:	DA5F1AFD182D25ADE376203F6AB3B8CD
SHA1:	6DBCC14C2EE670330CF81E7073D8AA35E836F541
SHA-256:	6909ACE5853F00FB4111D7284F6014C59204FB56B984971D798436F8158C1E98
SHA-512:	8E083F5A067A3B8D296F1ED5E54685453DD6A2B84653868FACB8D141150DF42832B8F15BAB3B13A63365893CDA0078D9EE686F81C3B304510760C0D895A53D8A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0bf76b9bc9d54d30a9d71f7ebcc589d9.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:779140KB8D4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.513778092460857
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8DWWCB0bk2jFQMzKaBu:qgFqo6g7/+0+f+M8KRB0NTmh
MD5:	2EE83D87E886A2FAB3BE36E3E76391F3
SHA1:	BB31ADED17393DE4F5D0A1746DECDEC1AB65216E
SHA-256:	0203EB96A235335DB4E707F496ABAB6A21BB54EC9032BFA47F83942CC161D204
SHA-512:	6C549F82A72B607BF478B38B9B3DF507D52FDCFA2F86F4BBAC6894A73C0FBD94CB4098F496BF53D4C4A4BC250224B656B972464280EDFCD98AA525BD674579A5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6f31cfca4e504a3697521a1db1625a65.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77915MluVs1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.506542716065082
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MxG8x0jFQMzKaBu:qgFqdg7/+0+f+MZoTmh
MD5:	4D74B770AF7B356D58935336559D84BE
SHA1:	C1B8FE4023A155219C4C2DEF8DB197267A8A8B4F
SHA-256:	0D449D1768193A2ECB0073BB35C52D8D6E73B77AEA50C817472A0BB11613AA1C
SHA-512:	0EEEC71362471633E27567493F068823F7BE42A2562CF9A51B7C3BDCBDFCA323B6F3BE10BECD60C0C258CBC4CF7415C1820C77B875E75706E01A7BEDE6BC734D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b57234e26d34bfc963052a4c500c5db.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79434aq4Uj0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.404441395481713
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzOGY9DfDemjs1Han:SbFuFyLVIg1BG+f+MSGY9jDLjoa
MD5:	C74240567CEAB4FCB05A4F5885214F32
SHA1:	F0D02556FDEF9EF2572EEB7E50D643C47B5B8997
SHA-256:	4883077BA4D1A3AFE5998EED7E713CB6A3AE20E32587958CE7825A7A8158EF56
SHA-512:	A84D37585049DA69747FBC84C3607F8FF19C9858488F6CE05B2733D6B60809275E2F9A6E1260AFD9C735E5B27CB9C32EE4935D9B72299F23850E422A0D0A1613
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=959e1dbc67114693a02f154f8511b426.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0RqiDJR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0WCyezR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1273Isz0S

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.312374380404959
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gNNaq7RKt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+g/jKEthQHtPYq9M
MD5:	CF666904F327B28FB5FF7B5EF661BFB9
SHA1:	F925C9C3561A4D0C6AA1F15B96B6AF570C483C61
SHA-256:	9834BA963C8984144D5ED2D87898E5005FF78E515CEA302A4446E48C666B4685
SHA-512:	287636E804304D616DFB776DC57782EEE28225D981F8ADB3519CF2D0148D7A4C7746387F01186E7AFDFAFB666EC76FA29905190E5D4963161F4C3C973FAA9078
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1738066866597372.MONOTONIC=462471407.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Akyx6R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.466438116199026
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgNNaq7RKot6n:qgFq30dABibB3Tg/jRIn
MD5:	2E28D8CC71333229231C3A6A2F67F195
SHA1:	F27E730ABBF9FDD1186C3F5E73A5ECF83C94BD50
SHA-256:	53D69D2F799DE88ABCF5C4AB671AEB455217424FA23D9233DE4D917B2BA90893
SHA-512:	4D8ABDEA6B02DBAB1E31EE05771136D01146DF3AF10CB4807D92F0542B675FBD279D4CD03E2E84CE53E2C5619FAFC196905769152F82C7BEE0AD14A2B8595780
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1738066866597372.MONOTONIC=462471407.LAST_SESSION_TIMESTAMP=462637269.

/run/systemd/users/.#127ObN3HS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3109095007648275
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgNNRccSWoqWISURKo206qodoQ:SbFuFyL3BVgdL87iesnAiRJgNNaq7RKX
MD5:	86DE51DD6B8E6EF6BD8A9C3BD817C238
SHA1:	DE83F5F20F11F4A3C22FB2EE376B19350212ED23
SHA-256:	7EF3A3A02FEDC8CDDBD9C818423B5DACBD515DB0DA89AED4C2D8E0171F228EB8
SHA-512:	3FB5FC77D3E6BB4D9A9924728BF5E74390DE0065C41F3707DE592BB88AD0CCC7AD0C945DE932DF7E417A5A72DE1AAF2C9032D3BAA726FB6B6144EB74C93E64B2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1738066866597372.MONOTONIC=462471407.LAST_SESSION_TIMESTAMP=462637269.

/run/systemd/users/.#127smMiiQ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127zyfUoT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.312374380404959
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gNNaq7RKt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+g/jKEthQHtPYq9M
MD5:	CF666904F327B28FB5FF7B5EF661BFB9
SHA1:	F925C9C3561A4D0C6AA1F15B96B6AF570C483C61
SHA-256:	9834BA963C8984144D5ED2D87898E5005FF78E515CEA302A4446E48C666B4685
SHA-512:	287636E804304D616DFB776DC57782EEE28225D981F8ADB3519CF2D0148D7A4C7746387F01186E7AFDFAFB666EC76FA29905190E5D4963161F4C3C973FAA9078
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1738066866597372.MONOTONIC=462471407.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:f2:+
MD5:	89090595D62574EAA0AB3DBF234A7919
SHA1:	1741BFD2E8DC29AD039DDCCDF0CF2BC47119DF95
SHA-256:	E04A4446065E90FDEEADB470B33061224CD5638F8C0D6948EDFC83D2AE478886
SHA-512:	C37F83D8571B682F7E20B462FA79BF00FA34488359A87E4E315ED4DF9812ADCC9B5C9F6507C45B205237272995F7228326ACEE992CB4BCD3A66542F1AE6838B9
Malicious:	false
Preview:	6311.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:Tlc1sXlXEWtl/Ycet:iQ+ylZ
MD5:	40503D3AECB10BBF8B974EF2DC7ED96C
SHA1:	EBB821A59097E422DF568605D8597E59468306C1
SHA-256:	B3523C294CC1A20D2C941DDAC0615A431786DB4764C04478DE40EB4A32D7F6A9
SHA-512:	12687B3BE311854CDF88083B2CD1C766E19AF6D0AFC286317D2F10CF5B1773E7C56F8083C5719F18AC789676F6F711AEFF595628A8763F0F6C47A5C13A962A8F
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................g........................................

/tmp/qemu-open.3VJgFi (deleted)

Download File

Process:	/tmp/Fantazy.arm4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	3.6101557137250917
Encrypted:	false
SSDEEP:	6:OgcaFF6ElR0Jznj/VUX/vYcaFF6ElR0JzC7Y/V3Y/VjmsVot/VOArB/VH:O9anlR0JznyXFanlR0JzDl
MD5:	E888997CE90EC1D72A0041120C27308A
SHA1:	385FA5118374C0997CA2F55D2F054DCCF5A6FC81
SHA-256:	1E8E4776C22C6F83FEF33E47F0B339E3005AE3339B0EE1514B3BC97592B40814
SHA-512:	89F757CDF4E88844A9A23AFB269EEC66EA3438BAFAAE971649C9E68179F6F830CA16582190BFBDBC4F10C78E5E80C855AF3642DBE6A61C2FDC38300FFC8C751B
Malicious:	false
Preview:	8000-1b000 r-xp 00000000 fd:00 531563 /tmp/Fantazy.arm4.elf.22000-23000 rw-p 00012000 fd:00 531563 /tmp/Fantazy.arm4.elf.23000-24000 rw-p 00000000 00:00 0 .24000-26000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.18IY02

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.910583537473274
Encrypted:	false
SSDEEP:	24:BK37FKbqGZ4I9ZedTZ3zCwi/uAv4uA2+Vv0pYr4oJr4KwrCQU:2dp0vmfVWYr4Or4xrCn
MD5:	DDBB0B6CE2F472364C87EB9094E12A14
SHA1:	62B9569C2CFCD25CC258DF5CCD1639379D4E2690
SHA-256:	02018992EB0BA0737455E0B147F548B496E17322CAA6A59CFD906A44D7701ED5
SHA-512:	89D4156ABC7E0C7A0B0F3448FC078C1BFEAF18A181ACA8D4B809D06A32DC0A8E4320C66C9918FE80C70269379575A307D75AD57AFC65E832D262AD2AC7815EA3
Malicious:	false
Preview:	Jan 28 06:20:43 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' known.Jan 28 06:20:43 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 28 06:20:45 galassia systemd-logind[6317]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 28 06:20:45 galassia systemd-logind[6317]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 28 06:20:45 galassia systemd-logind[6317]: User enumeration failed: Invalid argument.Jan 28 06:20:45 galassia systemd-logind[6317]: User of session c2 not known..Jan 28 06:20:45 galassia systemd-logind[6317]: User of session 2 not known..Jan 28 06:20:45 galassia systemd-logind[6317]: User of session c1 not known..Jan 28 06:20:45 galassia systemd-logind[6317]: Session enumeration failed: No such file or directory.Jan 28 06:20:45 galassia systemd-logind[6317]: Watching system buttons on /dev/input/event

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4163404862146578
Encrypted:	false
SSDEEP:	3:F31Hlis8tvax5VllKs8tvax5Fl:F3/8tsf8t8
MD5:	1E8D2DB256020D59D732FB039B7ACD33
SHA1:	4943CD0FF86B2780A889B75C61398CF242F16463
SHA-256:	141559C0B5FDBBC443B27DB29EB8F03273D6CE2C9705ED7E0A14BFFFCB8179ED
SHA-512:	21CE925460EC92C213B8CE0EFA192A9169ED433083115A4F7FE716F753F4E502128ED7C811022BD7DD1CD396ED29584FC802F851B768AD921ED2AD6F53D18E45
Malicious:	false
Preview:	LPKSHHRH.................]3KI.H.SV......................................]3KI.H.SV.............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlNmiLvwS/dmiLvwW/:F30iLvwSsiLvwG
MD5:	244C625647CBD606193D17C5DB7F7CAA
SHA1:	193B448645B43229BB00A14BE499E03E3D17F5C7
SHA-256:	AF32C8FD6713D3143BEC88AF5AC05EFFB68BCEB4B0AAF11DD8D90D0E910063CF
SHA-512:	F7349B8008CCB25374553B3FF36AB73722651F86F8E68A9DCD9E2781F5D1E876CF8CBA618E2C5A34754591FA93B2EA9F08F126EF4D1C2B1FA1981F58D709A95F
Malicious:	false
Preview:	LPKSHHRH................].W..4Gw.J.C+.v.................................].W..4Gw.J.C+.v.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6781
Entropy (8bit):	4.71769096561006
Encrypted:	false
SSDEEP:	48:6/SwJxS/+SXNRuhd3JOb4wyX09zH+CN1Vjry9JVyF8CytCX5yrNyIJxy+kDyBGJC:ijxPCQB89YOqQq2feM1f9eNv
MD5:	72FCFEF32B7A4D1D16EAB313DE9C6564
SHA1:	65E5C6744011F6FC3B8D0733340066338E94A885
SHA-256:	0CF08B4D4A076A6456B251EC5BD77445AFD7CBED939B801540846A576ED10EA1
SHA-512:	106ED163E838961313954139237D320BEF80E164FE6F4BF6F4F7A2D73F471C7D2C8856F0CBE4CB9088806BABDF3EDD0CF19E8C2836596615CCE6F2F06F1A8A73
Malicious:	false
Preview:	Jan 28 06:20:44 galassia kernel: [ 437.613769] Reached call limit: pid 6240, name read.Jan 28 06:20:44 galassia kernel: [ 439.839406] New task spawned: old: (tgid 6387, tid 6387), new (tgid: 6387, tid: 6391).Jan 28 06:20:44 galassia kernel: [ 439.841297] New task spawned: old: (tgid 6387, tid 6387), new (tgid: 6387, tid: 6392).Jan 28 06:20:44 galassia kernel: [ 439.849569] New task spawned: old: (tgid 6387, tid 6391), new (tgid: 6387, tid: 6393).Jan 28 06:20:45 galassia kernel: [ 440.130855] blocking signal 0: 6240 -> 1860.Jan 28 06:20:45 galassia kernel: [ 440.843346] New task spawned: old: (tgid 6394, tid 6394), new (tgid: 6395, tid: 6395).Jan 28 06:20:45 galassia kernel: [ 440.984094] New task spawned: old: (tgid 6395, tid 6395), new (tgid: 6396, tid: 6396).Jan 28 06:20:46 galassia kernel: [ 441.573761] New task spawned: old: (tgid 6394, tid 6394), new (tgid: 6397, tid: 6397).Jan 28 06:20:46 galassia kernel: [ 441.645043] New task spawned: old: (tgid 6397, tid 6397), new (t

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	32083
Entropy (8bit):	5.0180831454736605
Encrypted:	false
SSDEEP:	768:BuF5DaloeC4qSWQ2cJtrK6WAphtbdt5zmWCotgcaM7nBxTPNKIU2YW68jthHX5tS:0qaWc7
MD5:	3369434E7FE21CEE6AE6B8E18C9A5FDE
SHA1:	BEEEFF51957C7F6CEF0818B0E3618692AE2597C3
SHA-256:	AC480EC98F20EC5C09CBAFCD8C7AF2F0A2715EF146114AFD9D9512B9D863FE14
SHA-512:	27BA9419F8E9E8A69F666495C3361DF7910C0096D31180AEFB5B0347015EEF8D9A353218F99A2954EC5915CF0C99D509FBFD73F607ED370F2B9DA3976A15385E
Malicious:	false
Preview:	Jan 28 06:20:43 galassia [2063]: xfce4-panel: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 28 06:20:43 galassia [2074]: xfdesktop: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 28 06:20:43 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Jan 28 06:20:43 galassia [2069]: Thunar: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 28 06:20:43 galassia gdm3: Child process 1389 was already dead..Jan 28 06:20:43 galassia [2077]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 28 06:20:43 galassia multipathd[658]: sda: add missing path.Jan 28 06:20:43 galassia multipathd[658]: sda: failed to get udev uid: Invalid argument.Jan 28 06:20:43 galassia multipathd[658]: sda: failed to get sysfs uid: Invalid argument.Jan 28 06:20:43 galassia multipathd[658]: sda: failed to get sgio uid: No such file or directory.Jan 28 06:20:43 galassia gdm3: U

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:Tlc1sXlXEWtl/Ycet:iQ+ylZ
MD5:	40503D3AECB10BBF8B974EF2DC7ED96C
SHA1:	EBB821A59097E422DF568605D8597E59468306C1
SHA-256:	B3523C294CC1A20D2C941DDAC0615A431786DB4764C04478DE40EB4A32D7F6A9
SHA-512:	12687B3BE311854CDF88083B2CD1C766E19AF6D0AFC286317D2F10CF5B1773E7C56F8083C5719F18AC789676F6F711AEFF595628A8763F0F6C47A5C13A962A8F
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................g........................................

Source: Fantazy.arm4.elf	Virustotal: Detection: 56%			Perma Link
Source: Fantazy.arm4.elf	ReversingLabs: Detection: 68%

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.118108050960725
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.arm4.elf
File size:	76'620 bytes
MD5:	0c9b710b7faa928572afe6b73508ed6d
SHA1:	4c26c1a50facc47199b4daed93e781f5aaa43536
SHA256:	b51519d665a607995cd0b46c241b8f10a038bf2d71ff52d35f083caf2db7c8eb
SHA512:	24af1bb1c2fc0270172795b0b5e17865e143acd86ef6a61b4710d6c7036ca048fa0647a2ada261169d3959e30c0bb0ff7fddc5f0c0aadebc5b58c0c56d17f96d
SSDEEP:	1536:DX7706VqwNnAxcd9xBqeD5ZCnwXfU2/PJGBl1y:DX77ZVqwNnWABqsinwM2nQBl1y
TLSH:	EF730786BC80EA16C7C05777FE6F108E3315A7D8E1DA32029C256FA07B8ED2B0D66755
File Content Preview:	.ELF...a..........(.........4....)......4. ...(.....................L'..L'..............P'..P'..P'..,...............Q.td..................................-...L."....D..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	76220
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x11400	0x0	0x6	AX	16
.fini	PROGBITS	0x194b0	0x114b0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x194c4	0x114c4	0x1288	0x0	0x2	A	4
.ctors	PROGBITS	0x22750	0x12750	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x22758	0x12758	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x22764	0x12764	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x2297c	0x1297c	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1297c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1274c	0x1274c	6.1381	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x12750	0x22750	0x22750	0x22c	0x784	2.9691	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 28, 2025 13:20:42.782675982 CET	192.168.2.23	8.8.8.8	0x9b73	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 28, 2025 13:20:42.782728910 CET	192.168.2.23	8.8.8.8	0xc72b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 28, 2025 13:20:43.068936110 CET	192.168.2.23	8.8.8.8	0x6276	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 28, 2025 13:20:42.789463043 CET	8.8.8.8	192.168.2.23	0x9b73	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 28, 2025 13:20:42.789463043 CET	8.8.8.8	192.168.2.23	0x9b73	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-28 12:20:50 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-28 12:20:50 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-28 12:20:50 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-28 12:20:50 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Tue, 28 Jan 2025 12:20:50 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	12:20:04
Start date (UTC):	28/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	12:20:12
Start date (UTC):	28/01/2025
Path:	/tmp/Fantazy.arm4.elf
Arguments:	/tmp/Fantazy.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	12:20:13
Start date (UTC):	28/01/2025
Path:	/tmp/Fantazy.arm4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	12:20:20
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:22
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:39
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:41
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:42
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:43
Start date (UTC):	28/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	12:20:44
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:45
Start date (UTC):	28/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	12:20:46
Start date (UTC):	28/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6471/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75482E1yzT3

/run/systemd/journal/streams/.#9:75649F8EqE1

/run/systemd/journal/streams/.#9:75775OIgUJ1

/run/systemd/journal/streams/.#9:75831Ai9hf0

/run/systemd/journal/streams/.#9:75836o79G30

/run/systemd/journal/streams/.#9:76066npluk0

/run/systemd/journal/streams/.#9:76084GZvHk0

/run/systemd/journal/streams/.#9:76088rZnIM1

/run/systemd/journal/streams/.#9:768014ldyx1

/run/systemd/journal/streams/.#9:76916j8iPL3

/run/systemd/journal/streams/.#9:77051cynQ82

/run/systemd/journal/streams/.#9:77291XRVSn1

/run/systemd/journal/streams/.#9:77293EGHdc1

/run/systemd/journal/streams/.#9:77437DeI4Q2

/run/systemd/journal/streams/.#9:77730ZMTbo4

/run/systemd/journal/streams/.#9:77837pAsnS0

/run/systemd/journal/streams/.#9:778911InQP0

/run/systemd/journal/streams/.#9:77892aJsrW0

/run/systemd/journal/streams/.#9:779140KB8D4

/run/systemd/journal/streams/.#9:77915MluVs1

/run/systemd/journal/streams/.#9:79434aq4Uj0

/run/systemd/seats/.#seat0RqiDJR

/run/systemd/seats/.#seat0WCyezR

/run/systemd/users/.#1273Isz0S

/run/systemd/users/.#127Akyx6R

/run/systemd/users/.#127ObN3HS

Linux Analysis Report
Fantazy.arm4.elf

Start time (UTC):	12:20:47
Start date (UTC):	28/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	12:20:48
Start date (UTC):	28/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	12:20:50
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:20:52
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:21:03
Start date (UTC):	28/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	12:21:04
Start date (UTC):	28/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	12:21:06
Start date (UTC):	28/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	12:21:07
Start date (UTC):	28/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	12:21:08
Start date (UTC):	28/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	12:21:22
Start date (UTC):	28/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933