Create Interactive Tour

Linux Analysis Report
mips.elf

Overview

General Information

Sample name:	mips.elf
Analysis ID:	1648242
MD5:	c385fa71adbf8a2078c9b2d3286b7945
SHA1:	8a2bbab07f4b955910517a61e64d327d4142097a
SHA256:	4263e3cbbb06ce18c7020c66f3565606e0d2fab6d294967f7e4ed9ee3eff57e1
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Okiru

Score:	88
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Gafgyt

Yara detected Okiru

Reads system files that contain records of logged in users

Sample is packed with UPX

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648242
Start date and time:	2025-03-25 17:20:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mips.elf
Detection:	MAL
Classification:	mal88.spre.troj.evad.linELF@0/46@5/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/mips.elf
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

mips.elf (PID: 6225, Parent: 6141, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mips.elf

mips.elf New Fork (PID: 6227, Parent: 6225)

mips.elf New Fork (PID: 6229, Parent: 6225)

mips.elf New Fork (PID: 6231, Parent: 6225)

mips.elf New Fork (PID: 6233, Parent: 6231)

mips.elf New Fork (PID: 6235, Parent: 6231)

mips.elf New Fork (PID: 6237, Parent: 6231)

mips.elf New Fork (PID: 6240, Parent: 6231)

mips.elf New Fork (PID: 6246, Parent: 6231)

systemd New Fork (PID: 6249, Parent: 1)

journalctl (PID: 6249, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6269, Parent: 1)

dbus-daemon (PID: 6269, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6278, Parent: 1320)

Default (PID: 6278, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6283, Parent: 1)

rsyslogd (PID: 6283, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6284, Parent: 1860)

pulseaudio (PID: 6284, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 6285, Parent: 2038)

fusermount (PID: 6285, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gdm3 New Fork (PID: 6286, Parent: 1320)

Default (PID: 6286, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6289, Parent: 1320)

Default (PID: 6289, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6297, Parent: 1)

systemd-journald (PID: 6297, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6298, Parent: 1)

dbus-daemon (PID: 6298, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6299, Parent: 1)

rsyslogd (PID: 6299, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6308, Parent: 1)

systemd-logind (PID: 6308, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6366, Parent: 1)

gpu-manager (PID: 6366, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6369, Parent: 6366)

sh (PID: 6369, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6370, Parent: 6369)

grep (PID: 6370, Parent: 6369, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6371, Parent: 6366)

sh (PID: 6371, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6372, Parent: 6371)

grep (PID: 6372, Parent: 6371, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6374, Parent: 6366)

sh (PID: 6374, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6375, Parent: 6374)

grep (PID: 6375, Parent: 6374, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6376, Parent: 6366)

sh (PID: 6376, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6377, Parent: 6376)

grep (PID: 6377, Parent: 6376, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6378, Parent: 6366)

sh (PID: 6378, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6379, Parent: 6378)

grep (PID: 6379, Parent: 6378, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6380, Parent: 6366)

sh (PID: 6380, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6381, Parent: 6380)

grep (PID: 6381, Parent: 6380, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6382, Parent: 6366)

sh (PID: 6382, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6383, Parent: 6382)

grep (PID: 6383, Parent: 6382, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6384, Parent: 6366)

sh (PID: 6384, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6385, Parent: 6384)

grep (PID: 6385, Parent: 6384, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6373, Parent: 1)

agetty (PID: 6373, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6386, Parent: 1)

generate-config (PID: 6386, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6387, Parent: 6386)

pkill (PID: 6387, Parent: 6386, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6388, Parent: 1)

journalctl (PID: 6388, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6394, Parent: 1)

gdm-wait-for-drm (PID: 6394, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6400, Parent: 1)

gdm3 (PID: 6400, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6403, Parent: 6400)

plymouth (PID: 6403, Parent: 6400, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6417, Parent: 6400)

gdm-session-worker (PID: 6417, Parent: 6400, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6423, Parent: 6417)

gdm-wayland-session (PID: 6423, Parent: 6417, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6425, Parent: 6423)

dbus-daemon (PID: 6425, Parent: 6423, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6427, Parent: 6425)

dbus-daemon New Fork (PID: 6428, Parent: 6427)

false (PID: 6428, Parent: 6427, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6429, Parent: 6423)

dbus-run-session (PID: 6429, Parent: 6423, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6430, Parent: 6429)

dbus-daemon (PID: 6430, Parent: 6429, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6431, Parent: 6400)

Default (PID: 6431, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6432, Parent: 6400)

Default (PID: 6432, Parent: 6400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6404, Parent: 1)

accounts-daemon (PID: 6404, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6408, Parent: 6404)

language-validate (PID: 6408, Parent: 6404, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6409, Parent: 6408)

language-options (PID: 6409, Parent: 6408, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6410, Parent: 6409)

sh (PID: 6410, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6411, Parent: 6410)

locale (PID: 6411, Parent: 6410, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6412, Parent: 6410)

grep (PID: 6412, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6413, Parent: 1)

polkitd (PID: 6413, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6458, Parent: 1860)

dbus-daemon (PID: 6458, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6459, Parent: 1860)

pulseaudio (PID: 6459, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6462, Parent: 1)

rtkit-daemon (PID: 6462, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6225	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6227	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6229	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6231	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6233	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6235	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6237	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6240	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mips.elf PID: 6246	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 22 entries

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mips.elf	Virustotal: Detection: 35%			Perma Link
Source: mips.elf	ReversingLabs: Detection: 36%

Source: /usr/bin/pkill (PID: 6387)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:40002 -> 196.251.83.185:777

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6299)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6297)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6400)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6425)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.244.162.115
Source: unknown	TCP traffic detected without corresponding DNS query: 121.62.241.74
Source: unknown	TCP traffic detected without corresponding DNS query: 197.225.199.115
Source: unknown	TCP traffic detected without corresponding DNS query: 158.196.83.113
Source: unknown	TCP traffic detected without corresponding DNS query: 100.169.154.102
Source: unknown	TCP traffic detected without corresponding DNS query: 42.89.70.190
Source: unknown	TCP traffic detected without corresponding DNS query: 100.253.246.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.236.20.175
Source: unknown	TCP traffic detected without corresponding DNS query: 161.24.188.86
Source: unknown	TCP traffic detected without corresponding DNS query: 103.183.4.201
Source: unknown	TCP traffic detected without corresponding DNS query: 204.70.77.9
Source: unknown	TCP traffic detected without corresponding DNS query: 4.49.174.235
Source: unknown	TCP traffic detected without corresponding DNS query: 223.90.197.158
Source: unknown	TCP traffic detected without corresponding DNS query: 125.46.16.85
Source: unknown	TCP traffic detected without corresponding DNS query: 130.39.52.63
Source: unknown	TCP traffic detected without corresponding DNS query: 101.255.128.255
Source: unknown	TCP traffic detected without corresponding DNS query: 115.40.114.211
Source: unknown	TCP traffic detected without corresponding DNS query: 197.98.126.200
Source: unknown	TCP traffic detected without corresponding DNS query: 196.84.212.251
Source: unknown	TCP traffic detected without corresponding DNS query: 103.91.231.30
Source: unknown	TCP traffic detected without corresponding DNS query: 88.161.253.192
Source: unknown	TCP traffic detected without corresponding DNS query: 84.61.61.98
Source: unknown	TCP traffic detected without corresponding DNS query: 57.77.167.14
Source: unknown	TCP traffic detected without corresponding DNS query: 51.21.240.192
Source: unknown	TCP traffic detected without corresponding DNS query: 102.189.74.21
Source: unknown	TCP traffic detected without corresponding DNS query: 219.6.143.243
Source: unknown	TCP traffic detected without corresponding DNS query: 105.99.27.184
Source: unknown	TCP traffic detected without corresponding DNS query: 172.68.103.241
Source: unknown	TCP traffic detected without corresponding DNS query: 177.130.166.224
Source: unknown	TCP traffic detected without corresponding DNS query: 146.248.206.248
Source: unknown	TCP traffic detected without corresponding DNS query: 151.188.14.130
Source: unknown	TCP traffic detected without corresponding DNS query: 64.66.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 220.114.49.79
Source: unknown	TCP traffic detected without corresponding DNS query: 72.214.234.17
Source: unknown	TCP traffic detected without corresponding DNS query: 197.158.23.239
Source: unknown	TCP traffic detected without corresponding DNS query: 174.187.160.147
Source: unknown	TCP traffic detected without corresponding DNS query: 137.134.84.50
Source: unknown	TCP traffic detected without corresponding DNS query: 84.188.27.64
Source: unknown	TCP traffic detected without corresponding DNS query: 44.121.44.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.36.11.129
Source: unknown	TCP traffic detected without corresponding DNS query: 103.5.122.162
Source: unknown	TCP traffic detected without corresponding DNS query: 217.0.179.159
Source: unknown	TCP traffic detected without corresponding DNS query: 221.219.79.192
Source: unknown	TCP traffic detected without corresponding DNS query: 60.135.38.17
Source: unknown	TCP traffic detected without corresponding DNS query: 34.236.202.5
Source: unknown	TCP traffic detected without corresponding DNS query: 218.233.162.108
Source: unknown	TCP traffic detected without corresponding DNS query: 90.93.226.175
Source: unknown	TCP traffic detected without corresponding DNS query: 185.204.165.89
Source: unknown	TCP traffic detected without corresponding DNS query: 199.39.88.4

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: mips.elf	String found in binary or memory: http://upx.sf.net
Source: syslog.44.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53066
Source: unknown	Network traffic detected: HTTP traffic on port 53066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 789, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 721, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 777, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 4502, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6050, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 721, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 777, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4502, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6050, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6210, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6237, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6246, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6249, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4474, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6172, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6233, result: unknown	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 4502, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6050, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6227)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 721, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 777, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4502, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6050, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6210, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6237, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6246, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6249, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4474, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6172, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/mips.elf (PID: 6233)	SIGKILL sent: pid: 6233, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal88.spre.troj.evad.linELF@0/46@5/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6269)	File: /proc/6269/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6285)	File: /proc/6285/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File: /proc/6298/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6425)	File: /proc/6425/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6430)	File: /proc/6430/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6458)	File: /proc/6458/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76550MD0kHk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76551pTH24n	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76552EW9XGk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76553KeCuZl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76554ujUZQk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76555jivztn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76558yWczfl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76565K0zwfl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76566Qwc04j	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76575Q7ICKl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76576FHw7Yk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:766686gusWl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:76741wXXv3j	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77842PFbw9l	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77118Py2kVn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:771401BLPUj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77149P0pAql	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77170EcYUYm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77171ImDhWk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:771870tRkfk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77188WFWGuj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:772997lbzNl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:77322VdGU1m	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File: /run/systemd/journal/streams/.#9:7733466Viqk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/seats/.#seat0N7fvsb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/users/.#127laoG1c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/users/.#1272EZgz9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/seats/.#seat0eH1bV9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/users/.#127cLc3rd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/users/.#127bsDBoa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6308)	File: /run/systemd/users/.#1270TxiYb	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6423)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6404)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6404)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6413)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6462/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6300/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6300/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6423/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6400/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6413/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6404/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6459/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6459/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6459/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6308/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6417/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6417/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6395/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6297/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/6299/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2097/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	File opened: /proc/2050/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6369)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6371)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6374)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6376)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6378)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6380)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6382)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6384)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6410)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6370)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6372)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6375)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6377)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6379)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6381)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6383)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6385)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6387)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6297)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6373)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6400)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6400)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6404)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6404)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6299)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6299)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6366)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: mips.elf

Submission file: segment LOAD with 7.9679 entropy (max. 8.0)

Source: /usr/bin/gpu-manager (PID: 6366)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6387)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/mips.elf (PID: 6225)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6297)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6299)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6366)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6373)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6417)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6459)	Queries kernel information via 'uname':	Jump to behavior

Source: mips.elf, 6225.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6227.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6229.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6231.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6233.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6235.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6237.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6240.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6246.1.0000561f5913e000.0000561f591e5000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: mips.elf, 6233.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.zYoslu(
Source: mips.elf, 6225.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6227.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6229.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6231.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6233.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6235.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6237.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6240.1.0000561f5913e000.0000561f591e5000.rw-.sdmp, mips.elf, 6246.1.0000561f5913e000.0000561f591e5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mips.elf, 6233.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.zYoslu
Source: mips.elf, 6225.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6227.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6229.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6231.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6233.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6235.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6237.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6240.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6246.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mips.elf
Source: mips.elf, 6225.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6227.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6229.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6231.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6233.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6235.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6237.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6240.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp, mips.elf, 6246.1.00007ffe13ba3000.00007ffe13bc4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6404)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: 6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY

Yara detected Okiru

Source: Yara match	File source: 6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6225, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6246, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: 6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY

Yara detected Okiru

Source: Yara match	File source: 6231.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6235.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6246.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f696c400000.00007f696c42a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6225, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6231, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6233, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6235, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6237, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mips.elf PID: 6246, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mips.elf	36%	Virustotal		Browse
mips.elf	36%	ReversingLabs	Linux.Trojan.Multiverze

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.44.dr	false		high
http://upx.sf.net	mips.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.157.165.75	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
36.2.128.225	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
32.197.255.40	unknown	United States	2686	ATGS-MMD-ASUS	false
201.117.138.89	unknown	Mexico	8151	UninetSAdeCVMX	false
168.218.227.247	unknown	United States	7925	WVNETUS	false
78.215.10.187	unknown	France	12322	PROXADFR	false
69.136.84.13	unknown	United States	7922	COMCAST-7922US	false
222.177.179.67	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
93.78.143.93	unknown	Ukraine	25229	VOLIA-ASUA	false
41.223.235.101	unknown	Burkina Faso	37008	Alink-FasoBF	false
160.98.148.70	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
169.151.225.172	unknown	United States	2386	INS-ASUS	false
91.163.62.135	unknown	France	12322	PROXADFR	false
181.128.231.61	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
77.114.162.151	unknown	Poland	8374	PLUSNETPlusnetworkoperatorinPolandPL	false
105.202.228.145	unknown	Egypt	36992	ETISALAT-MISREG	false
108.231.51.86	unknown	United States	7018	ATT-INTERNET4US	false
176.188.211.229	unknown	France	5410	BOUYGTEL-ISPFR	false
57.173.197.217	unknown	Belgium	2686	ATGS-MMD-ASUS	false
120.183.146.58	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
92.150.193.33	unknown	France	3215	FranceTelecom-OrangeFR	false
200.52.229.179	unknown	unknown	13999	MegaCableSAdeCVMX	false
8.118.131.255	unknown	United States	3356	LEVEL3US	false
135.212.107.77	unknown	United States	14962	NCR-252US	false
88.116.71.103	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
200.36.175.194	unknown	Mexico	7438	PegasoPCSSAdeCVMX	false
138.185.101.142	unknown	Brazil	61660	CRAPACSERVICOSDETELECOMUNICACOESLTDA-MEBR	false
58.136.19.114	unknown	Thailand	45430	SBN-AWN-IIG-AS-APSBN-IIGAWN-IIGtransitproviderTH	false
138.254.27.232	unknown	United States	7834	L3HARRIS-TECHNOLOGIESUS	false
122.8.145.97	unknown	China	132165	CONNECT-AS-APConnectCommunicationsPK	false
78.81.8.212	unknown	Russian Federation	16301	DATACOM-ASRU	false
150.172.224.201	unknown	United States	26438	MONROE-COMMUNITY-COLLEGEUS	false
164.112.126.124	unknown	Australia	14235	STATE-NM-US	false
108.109.177.36	unknown	United States	10507	SPCSUS	false
37.71.211.150	unknown	France	15557	LDCOMNETFR	false
186.193.179.18	unknown	Brazil	28191	JupiterTelecomunicacoeseInformaticaLtdaBR	false
142.169.181.111	unknown	Canada	852	ASN852CA	false
54.181.110.121	unknown	United States	16509	AMAZON-02US	false
171.93.227.232	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
220.10.100.162	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
27.205.147.223	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
158.189.84.7	unknown	United States	26577	BAESYSTEMSUS	false
158.86.6.184	unknown	United States	20379	NET-BAKERUS	false
156.233.94.73	unknown	Seychelles	26484	IKGUL-26484US	false
51.209.241.96	unknown	United States	2686	ATGS-MMD-ASUS	false
218.220.159.91	unknown	Japan	9617	ZAQJupiterTelecommunicationsCoLtdJP	false
188.121.234.154	unknown	France	29075	IELOIELOMainNetworkFR	false
35.115.160.235	unknown	United States	237	MERIT-AS-14US	false
79.151.201.52	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
180.149.144.142	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
58.141.203.20	unknown	Korea Republic of	10036	CNM-AS-KRDLIVEKR	false
141.249.81.143	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
71.125.167.227	unknown	United States	701	UUNETUS	false
113.54.168.222	unknown	China	24355	CNGI-CD-IX-AS-APCERNET2IXatUniversityofElectronicScie	false
5.13.37.194	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
68.127.214.189	unknown	United States	7018	ATT-INTERNET4US	false
148.241.189.51	unknown	Mexico	10436	InstitutoTecnologicoydeEstudiosSuperioresdeMonterrey	false
157.102.155.73	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
156.74.18.96	unknown	United States	29975	VODACOM-ZA	false
32.94.156.166	unknown	United States	2688	ATGS-MMD-ASUS	false
195.34.186.216	unknown	Germany	8495	INTERNET_AGFrankfurt-Munich-Stuttgart-Amsterdam-LondonDE	false
54.121.33.90	unknown	United States	16509	AMAZON-02US	false
208.193.157.163	unknown	United States	701	UUNETUS	false
111.231.115.124	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
194.39.250.20	unknown	Germany	41820	NOVI-ASUA	false
139.248.168.135	unknown	United States	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
90.245.42.78	unknown	United Kingdom	5378	VodafoneGB	false
168.150.126.98	unknown	United States	6192	UCDAVIS-COREUS	false
91.27.88.203	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
162.251.24.95	unknown	United States	63010	CITY-OF-LAGRANGE-GEORGAUS	false
217.242.29.88	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
180.65.53.164	unknown	Korea Republic of	10060	YONSEI01-AS-KRYONSEIUNIVERSITYHEALTHSYSTEMKR	false
79.171.212.101	unknown	Russian Federation	43437	VOIPRO-ASNL	false
50.127.76.154	unknown	United States	5650	FRONTIER-FRTRUS	false
91.64.30.47	unknown	Germany	31334	KABELDEUTSCHLAND-ASDE	false
159.189.154.48	unknown	United States	22284	AS22284-DOI-OPSUS	false
141.242.229.45	unknown	United States	18454	AUGSBURGUS	false
93.76.220.51	unknown	Ukraine	25229	VOLIA-ASUA	false
42.212.169.205	unknown	China	4249	LILLY-ASUS	false
146.220.241.40	unknown	Luxembourg	204590	SWISS-ASCH	false
166.120.252.44	unknown	Australia	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	false
37.22.225.167	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
104.1.138.69	unknown	United States	7018	ATT-INTERNET4US	false
108.37.138.32	unknown	United States	701	UUNETUS	false
213.70.185.74	unknown	Germany	702	UUNETUS	false
213.196.254.138	unknown	Germany	8422	NETCOLOGNEDE	false
85.81.117.124	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
48.106.176.21	unknown	United States	2686	ATGS-MMD-ASUS	false
52.29.68.110	unknown	United States	16509	AMAZON-02US	false
130.253.112.173	unknown	United States	14041	AS14041US	false
141.40.107.170	unknown	Germany	12816	MWN-ASDE	false
152.130.120.181	unknown	United States	29992	VA-TMP-COREUS	false
24.135.7.41	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	false
162.13.210.137	unknown	United Kingdom	15395	RACKSPACE-LONGB	false
130.117.115.156	unknown	United States	174	COGENT-174US	false
94.9.121.20	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
66.14.119.59	unknown	United States	5650	FRONTIER-FRTRUS	false
25.91.81.202	unknown	United Kingdom	7922	COMCAST-7922US	false
71.96.146.124	unknown	United States	5650	FRONTIER-FRTRUS	false
186.68.48.184	unknown	Ecuador	14522	SatnetEC	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Gafgyt, Okiru	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Gafgyt, Okiru	Browse	162.213.35.25
	whisper.powerpc440fp.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	garm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	tarm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	i.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	aarch64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse	57.236.51.152
	mpsl.elf	Get hash	malicious	Gafgyt, Okiru	Browse	57.152.216.138
	https://gamma.app/docs/New-PDF-Document-Received-74vnbtewtf5iot8?mode=present#card-apfrnygx92ssvqt	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	34.49.241.189
	arm7.elf	Get hash	malicious	Okiru	Browse	57.170.34.73
	http://nuhobarthouse.weebly.com	Get hash	malicious	Unknown	Browse	57.144.180.192
	https://app.kortex.co/public/document/8838161b-5f2e-4b7c-b66b-ddfd9db20ecd	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	34.149.66.134
	https://bbw.name/t3t/out.php?url=https://gamma.app/docs/Bish-Enterprises-c602sxm5n81qwyl?mode=present#card-i5uz51lfyfocdyu	Get hash	malicious	HTMLPhisher	Browse	34.49.241.189
	https://promo-offer.site/tnf_pt	Get hash	malicious	Unknown	Browse	34.49.23.1
	https://we.tl/t-J9PcqXV8XE	Get hash	malicious	Unknown	Browse	34.49.212.111
	https://app.heptabase.com/w/9572b61a878f03208943512867a816847d4d23b4f7ccb0a7fe97bab5d1ad7da7	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	34.128.128.0
VECTANTARTERIANetworksCorporationJP	mpsl.elf	Get hash	malicious	Gafgyt, Okiru	Browse	1.1.92.97
	g4za.sh4.elf	Get hash	malicious	Mirai	Browse	210.170.44.72
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.14.236.76
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	157.250.121.47
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	157.14.224.60
	hoho.sparc.elf	Get hash	malicious	Unknown	Browse	101.55.217.145
	hoho.i486.elf	Get hash	malicious	Unknown	Browse	114.69.8.58
	jkse.ppc.elf	Get hash	malicious	Unknown	Browse	122.222.44.119
	jkse.x86.elf	Get hash	malicious	Unknown	Browse	210.146.156.127
	nklspc.elf	Get hash	malicious	Unknown	Browse	114.69.8.14
UninetSAdeCVMX	m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse	189.247.30.9
	mpsl.elf	Get hash	malicious	Gafgyt, Okiru	Browse	200.67.77.173
	x86.elf	Get hash	malicious	Okiru	Browse	148.235.138.3
	0qAlAtfE22.exe	Get hash	malicious	Phorpiex	Browse	187.223.151.146
	g4za.arm7.elf	Get hash	malicious	Mirai	Browse	187.171.103.21
	g4za.sh4.elf	Get hash	malicious	Mirai	Browse	148.207.112.59
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	189.181.71.4
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	189.159.186.174
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	187.146.129.187
	owari.arm5.elf	Get hash	malicious	Unknown	Browse	201.102.45.168
NOS_COMUNICACOESPT	sh4.elf	Get hash	malicious	Gafgyt, Okiru	Browse	95.92.22.130
	Workspace Update.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.200.196.138
	https://promo-offer.site/tnf_pt	Get hash	malicious	Unknown	Browse	23.200.198.128
	https://tinyurl.com/2x5dks36__;!!KtM2tloZCg!t4Gwb4Io82PLGf5Ziyn1ynf2MK2R8tVwoHlt6AQrinUFsCCwJRl23VZd9oJ2PaWibwt0lcEQuPw3Iyz8vMIkjw$	Get hash	malicious	Unknown	Browse	23.200.196.24
	Player666.exe	Get hash	malicious	Unknown	Browse	23.200.196.9
	https://github.com/abunaj3/abjjd/releases/download/2/2.mp3	Get hash	malicious	Unknown	Browse	23.200.196.9
	owari.i486.elf	Get hash	malicious	Unknown	Browse	95.94.139.31
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	109.51.205.209
	Microsoft Security Slate - March 20, 2025.pdf	Get hash	malicious	Unknown	Browse	23.200.197.55
	hoho.armv5l.elf	Get hash	malicious	Unknown	Browse	109.49.178.59

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6428/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:V:V
MD5:	2A88DD55C22359319E549733C85D9915
SHA1:	9FD54B0F2A58D2EC27A30202E3F45907758A699A
SHA-256:	15FE8A9134D38D230F936E492F0F6B3F21DE5673F978C098D4D40F7EDF9763DF
SHA-512:	74D305D7E7F2A841271BBDAAB7FB34D8A5D1AA8B0D5F877EA98BDD4CE2A715349B5B61B55EF22EC85262DD508088B5BA0924ACCA6F82CB667B19E5470E846668
Malicious:	false
Reputation:	low
Preview:	6400.

/run/systemd/journal/streams/.#9:76550MD0kHk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.453796336013339
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv8zdFURdARDr8js77:SbFuFyLVIg1BG+f+McUn6r8ji4s
MD5:	896972E467C721C6D9601D6B6AC319FA
SHA1:	C782BE3E1F2E257C6A1D30F336DEAC405CD8A419
SHA-256:	84AEB0BF13CF9300E42C8C7717A1B69D9C48BC20E1ADD397B8C3DC13EFBFDD75
SHA-512:	2E92A93B0D1BEB2216B815226C6774155DAB86F858B423C1C15F4AAA6FD60551053FF2214B8CDB7C205190808D205CDA68C8D32E6C2B76CF197CAD70B6E2609B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e4f7d451ca4a4da18fa7914a6fee4f04.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76551pTH24n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.423020230037324
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms38Q2dE1jjNlsjs16:SbFuFyLVIg1BG+f+MsMQhdN2josQu
MD5:	E780C29E431EDEC875F3A7507DDFCA94
SHA1:	0C58F5A842701D7B322C6ADED93FE3ED660E934C
SHA-256:	31E272811C6CB75F59D568474F84BDCD6C350E3E7A4F0EDC40C5621E7AA38CA6
SHA-512:	61DC2B0B1671BDCFFE5677E84488DB7C1984C54B6377C4B4F9474F11CE076172DD829BB4F7E5CBFB659042A34B1AFD9AC11414F2A0B6A597EF04D72867CC4595
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f6972dbfe2fe4004becc8c67cb1b9921.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76552EW9XGk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3561937415295615
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy3p8RXSq5wVMqjsmM:SbFuFyLVIg1BG+f+My5AVwVZjdCLKzK
MD5:	6FD179150A3E9FFD10BA2488CC686A45
SHA1:	6931B0E7C39F36746A2BCD66393A6045DB99BBC2
SHA-256:	FD350BFC4432C34F300579CB73F47F336F38F2173720DDE66E2D96B2D9DD2E62
SHA-512:	954306BD5F3017DE34BBC1C8D1AB3306C05F43CE82D3E64AE7A7645D3096A31B39DD97BD923264015A9E5B176DDEBAD06DE9C0A7305CA7C707AF139B0C046B10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87ab40b8672d4278a480211b1ee09e9d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76553KeCuZl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.428927920322385
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8ZtY65jFmzXvn:qgFqo6g7/+0+f+M8ZtFQXvn
MD5:	29FF03968D02B02937E38EAAD0EF28FA
SHA1:	6404387DA4C4E7887EEAB3A91F39CB57F52354B9
SHA-256:	72BE7D59ADBBFAC2F592569DA98769F515C0EE8296AD8A5DA2B09A3CF02DECA9
SHA-512:	5EECC16B04E9DB4ACFEDE0F092A8900893BB2F95BD5C3DC06E1CE8F4ED229FD381337D726423865C9DB22FB57827548386EF52002006260DD398A836EA7A90E9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6972ee3c3732405a9102711dcfa628a2.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76554ujUZQk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.408393217195332
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M47dYwqjFmzXvn:qgFqdg7/+0+f+M4eQXvn
MD5:	94D1E29E29AA2BC10BB4AB46648C7BD0
SHA1:	2A2562F59E70498F1A88F1298D5B2313486B0B0D
SHA-256:	9A9E2E86058CA4CA7F28FDE21E4F3AEFC8181142A78BC1211B330EF140946BCD
SHA-512:	C44A64A441A769703B599BB201F8918377C885E2B0DF4BE59B0E9836188A7BC04D5AC7B60E616E2D543BC914BD00588650F47A8FC0A00AA3950199C255B8B2B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a10a576ec23e4e41af208323a992c5da.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76555jivztn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.348402679107859
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyUVBF3TAcAYzdvsZh:SbFuFyLVIg1BG+f+MyUVL3AKsZjtWL0
MD5:	621E4A6D648167A11110F89367D0B251
SHA1:	634EBC90174EF4CC834F75247CE9A0BD29F15A16
SHA-256:	9CC50B94EC412ACB8F842350068AF0702EDDC456631066B495C78708FCC0D3A3
SHA-512:	6675FE0A047C42D89437B0D7910FC4E4E078FB8904A723DA1368CF00EA3278C61E555C2329E5C48D6C49546556D5757C1C4F8929E5A61D84EA1222D04C972546
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8cfaba3f5d19446f9febd3a6bcbe8b68.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76558yWczfl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.376674998325925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7TtsVRm8WW0UvAgr2:SbFuFyLVIg1BG+f+MGeiYgrqjosQu
MD5:	3728FCD79047DC83C071B098626D43E0
SHA1:	0CEA8FB1DC33807E991F808CF1FD2C5B9F27C02C
SHA-256:	0A33F5D65DB904542F1A7EAB28CC436802DB4AD20A64409C4B76D53169C11E0D
SHA-512:	A6CE110A1DF787CD4ABF5360488EAC0F8E07DCC644F722ACEA55EC078CA8E6F191BF7066A7E6EBA17252936626322E846F235E9791F705F6E807F566B79E90A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=111daa61d0cc443b93a1e29c59dfb12a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76565K0zwfl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.378560463017037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu/3gTEsjsmNz0LKzK:SbFuFyLVIg1BG+f+Mu/QxjdCLKzK
MD5:	99B19BBCAEC23DA4BD03ED937B3AB594
SHA1:	647DDC1A82EB09C433C82A4B6AD2A4AD6F5D717E
SHA-256:	63101723286FDF3B44785F587784598D6061F60CC6FFB0B6A85A8919BCDAEAF9
SHA-512:	494DF9288A947DCDA5980AB2786994A6981929FFE91D0B248EF8AF564F10FDEE04BCB89BCBF8BE8F3BE2F8AF2457982539025C99F4FB40D3EDC771783631AA79
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db9082e4116b451190d862eb7b08c311.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76566Qwc04j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.485600949678795
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MxoAHBv5qjZcHcljX+:qgFq6g10+f+MyGimAu
MD5:	7366E75830EF5FED083E760E9162D9BD
SHA1:	D4A98AE3F4970D6579A3A64D66B82FAD18EFA020
SHA-256:	C2A72EB0A90E388081256229627E89B38DB771CFFCBEAD2F0C9C20A1DAD27265
SHA-512:	7C65742030F455425E5B5B5BF91EFB8FD44341C6F3A723413D0D7011CE33BDBBFBD55B1275484D3CA958E9E25977213C00D07F785DADF9241A4CE174E6137364
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=edbbe7f787894287a95d9d21157fb013.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76575Q7ICKl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4387805314888995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmo1HySGSIglsjs2ALAXA:SbFuFyLVIg1BAf+MokStEjNALyAZD
MD5:	B05265F753B85C29C3EAA21A715C401E
SHA1:	D317B8448DB7CEAC0070CF46541873028ACD802C
SHA-256:	7C7629858E634158F3F7DE5A1A5A0E8B6D161F4A6813E7D1AE437FFF24699522
SHA-512:	BF9819A60A9A7F7A941B41997374206C4E818C4C694C03C86AF30BCBEE302A966A9FFB6BEF4EEDDF8CC3FE1B082F5008B8D4A29D4AC479C7D5CFEDF72C1D941B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b46b0c677d4c40658524d92e6a70d2aa.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76576FHw7Yk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4971422205070875
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyfUaFS5nHGONlsjsv:SbFuFyLVIg1BG+f+My8IS5nHG7ji4s
MD5:	4B5AAB285335C5407DC3B38A65012F5C
SHA1:	B5AAB0A7AD007B88A9863A5BEFFF017BB91A4C92
SHA-256:	BF9C4C3A00092FD98B2C4186C74258B7E41201515B8020E68E39C7E946BBD1F0
SHA-512:	35298A076DB593ED761566EF421ACB7AE10CFE23EB4837695BC8949DC6029EA2343DA82B7BF489C5660F437EDB80AB698F80FAEE0FE10C9315D1852DE74794AF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=88818439768747ea8115ee8ca8bd02a1.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:766686gusWl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.420852441296509
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5Z52Iy9Y+sjswkClK:SbFuFyLVIg1BG+f+MH59y+jLkGq
MD5:	5BC98DCFC9404CF464F6A765E6BE58C7
SHA1:	9CA1E549C87F3F5730902E500B99864551A9B965
SHA-256:	020581BCDC6F98DD8D0F41FD9ACBE4D02404A1A50F127062C609CB3E810E4CFE
SHA-512:	5341BFB3FE1336D0AEBFC63DD09039ACF8D1E38E8A092BC457519EE5AEA570CFB160E492BE7625325BAD8AAB03CC2BB0AB901698B6BFDF74B285DD2A42C561B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=386f6214a86c45c5a5c1449357e46e7b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76741wXXv3j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4753128590125835
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzdGymAHvWg1xt2js2BI:SbFuFyLVIg1BAf+MF3u6xt2jNdQIeXD
MD5:	E88F3A56967B6CC2F2D0484DF48ECD89
SHA1:	4C94B9662B14D96ED0FC21F8EB4076FA5121AA3A
SHA-256:	FF30CB74941C8F890DF9A9FB83B6659CAE559D6DD01099660E92E2BFAD041F12
SHA-512:	ECF67B1C6E56B62B9CA49155A7EF0E2DA392B6242B84F7B16D754C5FB73ADC440BC352A3A0714D73FD09E2574C70FD2E722EBEC0DE4568B7A6A22E96FA196896
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9fdc04904f5a43ebaa83769a82b1cd24.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77118Py2kVn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.405312055080037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsAjdYXeQ8hUZ2rqjs2R:SbFuFyLVIg1BAf+Mskp2ZjNTZD
MD5:	2F25CF93F62D7A11D63DD59A0C648391
SHA1:	46AD7A8C8C7DF072B750EAF0C66EDAAC46F8C078
SHA-256:	9839503F4F6E31AAED264ECF1DCD8EDBCC77A9ACF8D213700070E311AB1DF07B
SHA-512:	3D960EDACC1A4772A3015C70002169C893D700B78CCD728627EBF18640DEA0D8B7D26330EBC9DAE65287C79376DFE1A5E72C53F8153A61A09642BE9A701F8B64
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fec2f4181d2f488b9558f7e86aa618e8.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:771401BLPUj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.439397829028171
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6sAd9IkvF2jLTTIWTIL:qgFq6g10+f+MO9JN6EWEL
MD5:	A8E64EB3C3AA2E139B799245F97AE7B5
SHA1:	972E2FC64285B766E2A4CB44391195C78F3FCA9D
SHA-256:	893B8F2AE1641EC232F7E11AB646D68872BF5370BD9C6987D99B0A84559C7F9E
SHA-512:	896C6E4506B60D34577C751A7D91E0F98ED0B03ED88C52B0ADFB0ECDE7B3BD0A768CC606D228EED4B7A45F045A07D9E599DD5270049D781ABF828EDA1F89D592
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=098e88d2172645aa994710467f4fa180.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77149P0pAql

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4350298087556554
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsxQ3hT+5XgicT0js1:SbFuFyLVIg1BG+f+MsW1o00jbVC
MD5:	41DD53E5C211D7FF506EF91C191A2EF7
SHA1:	50390B8D8E09679160D25247A4500DDBC4DA982B
SHA-256:	81D0944C3DFE75B3DD15DDF68DC3C1DF0FF2F1AAAE99612A0816ECBE7F04146B
SHA-512:	612ADC77540FD8472886C1AF8045DF771F3010A45D820C6D807DB10E47BB70B2ADFEA48D994974D945959B0FBC8AF66236ECAD28BBA371E8D4B1753F8FB841A4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f43a5dea53b2467b956f19f294743156.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77170EcYUYm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.392416224155536
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5qc3Z74XP0fVPsq:SbFuFyLVK6g7/+BG+f+M/ccfVUZjNq
MD5:	2F4C0B9E6C93DC913D29AFF5E2657B91
SHA1:	293DB282AD3DF9B269481AC6BFE16F0846ACA514
SHA-256:	13106397B214F23558A4D72A21D6F67443280D249784D4E0A34840C5A820DDE6
SHA-512:	F3143595B2F6421D55A128C8D8EF5E5246F0D8430C8F49BFF1E7E9B09C86287A2D2797DD055802E6B5DAC74B28FFABE461E0B4D92CD959B6CE098049031DA959
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38b502809f684604834f6626fe45290b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77171ImDhWk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.378206480908526
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrMxHSR1CmH8VShs:SbFuFyLVI6g7/+BG+f+MAxrmc8TjNq
MD5:	538BA843DC0F3AF8932DA7F34A5603AF
SHA1:	B9B5198E48D820B742B7D3C04C9D710F0C7DC2F7
SHA-256:	529262A60155062F9FCBA606B2A4D5534D204F55A1505239CC3E8918DB524DD9
SHA-512:	961FEAF36D89A38F3D5A69F920768C42E1CACD3B43163DF6C70AAE029311487F9A330DB8F13F1F8A950A2B588B2DFFBF6BE1476CF41E234264F9F5EE1C011314
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=af5747c58f47421da015c04ebfbd7d0d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:771870tRkfk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.506588687678348
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MNmUAqvwMqjFQMzKaBu:qgFqo6g7/+0+f+MWM4Tmh
MD5:	162262B229EFB3D90534E92E0A0364D4
SHA1:	578DA63AD89324DB2CD078DDC5666AE1CDCFAE7F
SHA-256:	78C72BB93F895D1847B9FB0EC79F5AF059CC622EA5ACF1459A13C5CEEC93C11F
SHA-512:	82CA2CF0B5BA68FA6ED1EE5082C3A2ED905F491BCDDF63280EDAD8312BF6427C89CEEF510D1C80B6574B154B68EC795DE3B4093ED953F530587EA5D7663D2319
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5f42a033d1ed49289a9843bea13a64fc.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77188WFWGuj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.484023402002223
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6rKEEUAIjFQMzKaBu:qgFqdg7/+0+f+MEKjUtTmh
MD5:	F0BEDB89FD74D1434FBD331E38177BE8
SHA1:	F915ECDAA099F1A1123D894AAC96582557F13DA4
SHA-256:	3D074CC737B007D079B3E6414E42C0F856837FD2DCF694ACBAF986876111E0B8
SHA-512:	331481E39F17A3F2A7076DA938C42D34C1182C26A180CBFD50739404D8ED956AC9A7D8D88596E92FFDBAD658DD6F3B78D07E1648E1948E12AC8EBB75357C373B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0829d958297a403a8a4e36dafdf62076.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:772997lbzNl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.409185294699913
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/v6jkUXrrxsjs1Han:SbFuFyLVIg1BG+f+MKjdb2joa
MD5:	D00D267FC40C212423E66F38E633758C
SHA1:	F7413354C602A0947859B2EA78F572DEA180A4EB
SHA-256:	A416D8AEF8D2CDD03170B97E4A9B764E1AA4E4D80D7E9C3B6EB1E5EDB3FA8DBC
SHA-512:	2BA157A0F261FCCC5C39185A12E014085A387711A9EA800576D0C5E9428E4BB8C4BDDE6DCBDCFA8C5D420E03659332B0CAD5978E2B79F4ABFCD70A1ECAC267BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=579bcd8838ec4708bc61289769f180b2.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:77322VdGU1m

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.2894426707306
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8lcOxrRpUxWCAvAgE:SbFuFyLVIg1BG+f+M8aG7qLAvRqjtWL0
MD5:	91F952989D75CAAF686E4DE14E6609D0
SHA1:	D7EA0064EF33D571A6B997E9BEE2B558A6D6B3AB
SHA-256:	F89539356F8A1B7B872A8C89A9468B41D20C2DFBCC75FD5C1AEA6F0BB63C995A
SHA-512:	648995AE5CB5460913E7034A9A65ED5EE0C81B44E3926D71F4F5F9423AD884B8827204ECDE54AA14702FC9F86B1916DDE557F22A11031A3D7B11C6922278F0EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=673a319aa422482daeb1e1e7b44de8ee.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:7733466Viqk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.381266043874965
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoELWr3VMlsjsjOdlE:SbFuFyLVIg1BG+f+MoB3K2jNE
MD5:	F33211E228F223FFBC2EB6FE06659F80
SHA1:	3F1868655CBB50EA53C4D2563ECDF60C9FDD197A
SHA-256:	868BF1D82A4525C2F5ADCA56596099FBB3AB411FFBC399B3DEF875A507E7448C
SHA-512:	0C534520984F2472013D1A09F0EDE0A016F47B92A0E0EA53D9536BD7EC942771E165B3EC5D601D00B436CC0CC979F9A9A1AA1B2FECC9628FB3822F25B75C53C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba07c794adca457e81741dd001ceb4d2.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77842PFbw9l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.433238651129979
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MvkS8Te22jdCt/rRMtq:qgFq6g10+f+Mc03CDL
MD5:	FA295B70E259D3569FEAE575BED59C6B
SHA1:	A90DF5E3660365C3B7332C82074DD523201A74C9
SHA-256:	C3D18FD15AED5C935D1CE33AD9DA22F603FDABA9DC9B63CA1C1E5C33A5A6DCC6
SHA-512:	8896097CE77429A8054BB8FB826095640DFB29C23BE8AC50810CAE354425F63A97E7B872314FBF639AEB1A793C3D6DC47636B61A51DD392F8FB0AEF0B5B6F34B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa0c4c2897124772a2620e2bf4252808.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/seats/.#seat0N7fvsb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0eH1bV9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1270TxiYb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4680850755679
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6ztQCgxzfQYot6jj:qgFq30dABibBUQCgxzQYoI3
MD5:	B808F8A5F6D25B03C838308A53B0D9CA
SHA1:	54394C1C464F2B32E813C05E2A05602FFCE2E459
SHA-256:	BB7379F858A7441694CE2A887459D149DB682C6768244FE702CDDFA5B6E99EE7
SHA-512:	E084E98DEEA6DFBF4E75E70F0B0A12D65DA8D3D2E56B3ABF6CDB6CCCBD7569C49FFD775E854E655D772D0D069B03A6912CA33F03FF57348FC5B1618AE6BB0590
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12408.REALTIME=1742919713110182.MONOTONIC=439898457.LAST_SESSION_TIMESTAMP=439974096.

/run/systemd/users/.#1272EZgz9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2966719162220866
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6mxJgxzfQw2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBjgxzQDthQHtPYq9M
MD5:	DBA324FB9B8C49766933BDC5527A7A13
SHA1:	A4731A364192C2F326A7642773DEB5C98AEDC6C4
SHA-256:	0CA0A7E48AFEB8BBD6CAB2B2476868A0E9B28B4C29F83769B512C23D01D62222
SHA-512:	5CC97039B9F730E292F933DBF015567DB0360835114DC338F3751014EDE79E7C708E91F8F0EDDF5D0B3DE309661E06FBB18A47D7C0156FBDE826076C80A2DE3F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12346.REALTIME=1742919713110182.MONOTONIC=439898457.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127bsDBoa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.31081747529929
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgQU3z5MwQcpo206qodBj:SbFuFyL3BVgdL87iesnAiRJgxzfQYotK
MD5:	75C154215AAF1B708D58C3AF219CA1A8
SHA1:	5CEE2F615FE9E4F92C2E9FDF6E382E084C501C56
SHA-256:	C8B229E6D1C28E65272ED37589DFA71AB8904C8CDC96F3D942317D0B971DAB19
SHA-512:	99E309F271F996E5799BF4F41920170ACAED22DB143CEB42BFBEF81A9DB2913CD0610CF8128D2D99DFFD328F64F99926BA714C598143EC434AEF39836EC0D015
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1742919713110182.MONOTONIC=439898457.LAST_SESSION_TIMESTAMP=439974096.

/run/systemd/users/.#127cLc3rd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2966719162220866
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6mxJgxzfQw2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBjgxzQDthQHtPYq9M
MD5:	DBA324FB9B8C49766933BDC5527A7A13
SHA1:	A4731A364192C2F326A7642773DEB5C98AEDC6C4
SHA-256:	0CA0A7E48AFEB8BBD6CAB2B2476868A0E9B28B4C29F83769B512C23D01D62222
SHA-512:	5CC97039B9F730E292F933DBF015567DB0360835114DC338F3751014EDE79E7C708E91F8F0EDDF5D0B3DE309661E06FBB18A47D7C0156FBDE826076C80A2DE3F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12346.REALTIME=1742919713110182.MONOTONIC=439898457.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127laoG1c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:3:3
MD5:	D77A6A44D98ABB3A6F38004229EC961A
SHA1:	60A0D730A302F8301BA97ACF3E5D9FE2FE7D1E9D
SHA-256:	B028B3044F8D57222BE32358FEA19071AC7A31216468E8B79B622BD0B41713D0
SHA-512:	3549A7D4621B3E7FD44A60CC1D2AD6BA543DE5E85EEAD6C6C1CADC7DFB22C4CEA5514F1B256A945CD155D0517397542AE9B413BF1CDF3FE28EEAE1BFBE1472D6
Malicious:	false
Preview:	6459.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:q61sXlXEWtl/g9HCjD/:nQ+ylAijD
MD5:	FDA1CC6C7AF1F892F5DB0D85BF6EB716
SHA1:	89F55F96EB9B40412992C109DE68BDE3BBC99A9F
SHA-256:	2C00BFA96734B109BD871D43AB6D374D3DFC19AE76CB59FFAC81A96135E7D601
SHA-512:	A3FD081AB13F5800E47822108516BB065AB88800CA16B1093D1AF1698BA4D4843378EA32219F8467132FA49B9A103F602FDAB2CCE7C058EBD2E4A50C4DF7D674
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.......................................

/tmp/qemu-open.zYoslu (deleted)

Download File

Process:	/tmp/mips.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:TgaLGn:TgAG
MD5:	640E98E7A87EC50F267F24DBC141D4DD
SHA1:	BC19B1CF25759386125D933665A8B429D9AE7E26
SHA-256:	6976993806B7CE05EA0AAA6BC975462833B19CF0D6DD4C9480F26FBAF66AF31D
SHA-512:	3887FBDFA33FF58EF35DDD9B1A2C9BDD611208904D8D371B2AFFE6E97F4C2EDA7A5BAA9786BDD3857AB6B31FE933CBE7290E7D9223671670A9BC739D457D4BA9
Malicious:	false
Preview:	/tmp/mips.elf.

/var/lib/AccountsService/users/gdm.B65G42

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2277
Entropy (8bit):	4.875836836693021
Encrypted:	false
SSDEEP:	24:ptAd/xttFds/x9tFdqZ42ZexB7mfnktAvlA2+VD0pYrrJrPoAmUwwrCQU:Uxx7CxrsbvafViYrdrPoAPPrCn
MD5:	B537D57D94CCC10FCFE68E60E37429A8
SHA1:	160D7F9F2F59AF53BD94E9B06F2BFC4750F462FD
SHA-256:	531D430C0AB5A14E1350F460CD5320F8B3DC72FB57B23C3DEC1DB3204EC0CF86
SHA-512:	5B95F8B3CC57B925FDED2CB8B59C099A292BA7C5027985004150B0C0951C829D9EBC9D4DBCD5A26E6AF9E0768AD42D10B8140860F18AFC80296FF46F4F00C4F1
Malicious:	false
Preview:	Mar 25 11:21:36 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Mar 25 11:21:36 galassia systemd-logind[797]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Mar 25 11:21:36 galassia systemd-logind[797]: Session 2 logged out. Waiting for processes to exit..Mar 25 11:21:37 galassia systemd-logind[797]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Mar 25 11:21:37 galassia systemd-logind[797]: Session c2 logged out. Waiting for processes to exit..Mar 25 11:21:37 galassia systemd-logind[6308]: Failed to add user by file name 127, ignoring: Invalid argument.Mar 25 11:21:37 galassia systemd-logind[6308]: Failed to add user by file name 1000, ignoring: Invalid argument.Mar 25 11:21:37 galassia systemd-logind[6308]: User enumeration failed: Invalid argument.Mar 25 11:21:37 galassia systemd-logind[6308]: User of session c2 not known..Mar 25 11:21:37 galassia systemd-logind[63

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlQo5qh1Io5qR:F3gkqUkq
MD5:	9868F4227AE7495C917198656ADF5963
SHA1:	62C2C31E1BB8C01090A039F061CFB79B0402EFC6
SHA-256:	39FA13DC17B119B5E570C61E6BD8AA0B422D3ED715AB9F900B59D63D2E7EE9BA
SHA-512:	48829A043A0493ADC5B21E3908F7DA50185F1113A9408931276B5A2330D3C28A2E9B504780BDD5861C306D1DB7E6E3383EABF8BF83F1A0238FAAB0DB33A81464
Malicious:	false
Preview:	LPKSHHRH................,{.LGM....8....................................,{.LGM....8............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	9882
Entropy (8bit):	4.767745416793337
Encrypted:	false
SSDEEP:	96:YTiDR6Y5E5hh+OrwKtVwFUehz8oh3OpWwN6q9/Bz3:zDH5E5j+Orlf6hz1+pz6w/Bz3
MD5:	5D8B399411A388D54D17BD233AE3F952
SHA1:	107E1D3E2D21299DBFEED992F97CE9458709C647
SHA-256:	E2EC1BEF46C918270D42DD0E4EAD195C1A9AA4CBB02D6FD1953DDAFA61D5FDAC
SHA-512:	CCDC0FF7F0C46B7E8A4EF2EB7DAD9EE5AB638569F90B5C86B4C8813E3E07AA6F798CDB6E1756736C82BE7AAFDB5C972CB295C346649567A86BD14C58E288FD57
Malicious:	false
Preview:	Mar 25 11:21:29 galassia kernel: [ 412.852414] blocking signal 9: 6227 -> 797.Mar 25 11:21:29 galassia kernel: [ 412.856313] 801 failed to write to log: -512.Mar 25 11:21:29 galassia kernel: [ 412.879396] blocking signal 9: 6227 -> 936.Mar 25 11:21:29 galassia kernel: [ 412.896794] blocking signal 9: 6227 -> 1320.Mar 25 11:21:29 galassia kernel: [ 412.903961] blocking signal 9: 6227 -> 1334.Mar 25 11:21:29 galassia kernel: [ 412.927215] blocking signal 9: 6227 -> 1335.Mar 25 11:21:29 galassia kernel: [ 412.935132] blocking signal 9: 6233 -> 797.Mar 25 11:21:29 galassia kernel: [ 412.960548] read error.Mar 25 11:21:29 galassia kernel: [ 412.960550] MD5 calculation failed.Mar 25 11:21:29 galassia kernel: [ 412.967363] blocking signal 9: 6233 -> 936.Mar 25 11:21:29 galassia kernel: [ 413.001143] blocking signal 9: 6233 -> 1320.Mar 25 11:21:29 galassia kernel: [ 413.003090] blocking signal 9: 6233 -> 1334.Mar 25 11:21:29 galassia kernel: [ 413.021656] blocking signal 9: 6227 -

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	44314
Entropy (8bit):	5.028418382470811
Encrypted:	false
SSDEEP:	768:QK5E5H+YQWK4kWK40YWKJIXbtM/A/6YYHzfpBpQ4M+YcoanNJzKqO0Q+asX59Lpu:yTw
MD5:	51596408567A9EAFDAC81AB340AECB15
SHA1:	D704A2BD8A201A51BC62F0644FD8455071E43EB2
SHA-256:	C3B60C793FBBF7DE0E061612076DFE658F703823DE881DDB285F725458346F82
SHA-512:	CBDB1048ABC6F8DE0EB5A96872314E12337B5D839B83509A176C25CAF5D999CFC016315B4EE80A90DAFA7DA5BC526489EC655991282CB8FD8CCBF29ED9BCEFFE
Malicious:	false
Preview:	Mar 25 11:21:29 galassia kernel: [ 412.841621] systemd[1]: rtkit-daemon.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.844371] systemd[1]: switcheroo-control.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.846146] systemd[1]: whoopsie.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.846885] systemd[1]: colord.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.848572] systemd[1]: packagekit.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.852414] blocking signal 9: 6227 -> 797.Mar 25 11:21:29 galassia kernel: [ 412.853679] systemd[1]: ModemManager.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.856313] 801 failed to write to log: -512.Mar 25 11:21:29 galassia kernel: [ 412.856929] systemd[1]: avahi-daemon.service: Failed with result 'signal'..Mar 25 11:21:29 galassia kernel: [ 412.863204] systemd[1]: polkit.service: Succeeded..Mar 25 11:21:29 galassia kernel: [ 412.865679] systemd[1]: udisks2.service: Succeeded..Ma

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:q61sXlXEWtl/g9HCjD/:nQ+ylAijD
MD5:	FDA1CC6C7AF1F892F5DB0D85BF6EB716
SHA1:	89F55F96EB9B40412992C109DE68BDE3BBC99A9F
SHA-256:	2C00BFA96734B109BD871D43AB6D374D3DFC19AE76CB59FFAC81A96135E7D601
SHA-512:	A3FD081AB13F5800E47822108516BB065AB88800CA16B1093D1AF1698BA4D4843378EA32219F8467132FA49B9A103F602FDAB2CCE7C058EBD2E4A50C4DF7D674
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.......................................

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.9662752552295695
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	mips.elf
File size:	60'976 bytes
MD5:	c385fa71adbf8a2078c9b2d3286b7945
SHA1:	8a2bbab07f4b955910517a61e64d327d4142097a
SHA256:	4263e3cbbb06ce18c7020c66f3565606e0d2fab6d294967f7e4ed9ee3eff57e1
SHA512:	16dec13bb4ee226cb2231df362c2d0a75ca97292129808926fea933263226f338b9d4102e2d57eb6af4936e195fc548dbfe939bef4a7c145cf12e20083b76d8a
SSDEEP:	1536:UCRWw2yJtzTxlN6UW+qUNAOquGvOMKmgohcBVJun:UCRWw26tlN6UW+qFsWOaBIVQn
TLSH:	3B5302F72F4DD661FA94C8725951370199244FA3E0079EAE34E2EAA77FB428430DB9C0
File Content Preview:	.ELF...........................4.........4. ...(..........................................4..G4..G4.................T...UPX!.h.........(...(.......W.......?.E.h4...@b..) ..]....E..K.Z..='./@..b;..xz(......!.~x......Q.........O...-..n.At...................

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10d9b8
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0xecfc	0xecfc	7.9679	0x5	R E	0x10000
LOAD	0x34a8	0x4734a8	0x4734a8	0x0	0x0	0.0000	0x6	RW	0x10000

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 17:21:32.803941965 CET	42095	53	192.168.2.23	8.8.8.8
Mar 25, 2025 17:21:32.804043055 CET	37141	53	192.168.2.23	8.8.8.8
Mar 25, 2025 17:21:32.919660091 CET	53	37141	8.8.8.8	192.168.2.23
Mar 25, 2025 17:21:37.805685043 CET	39472	53	192.168.2.23	1.1.1.1
Mar 25, 2025 17:21:37.916866064 CET	53	39472	1.1.1.1	192.168.2.23
Mar 25, 2025 17:21:37.917258978 CET	58750	53	192.168.2.23	1.1.1.1
Mar 25, 2025 17:21:38.023782969 CET	53	58750	1.1.1.1	192.168.2.23
Mar 25, 2025 17:21:38.785075903 CET	43190	53	192.168.2.23	1.1.1.1
Mar 25, 2025 17:21:38.890532970 CET	53	43190	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 25, 2025 17:21:34.158268929 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Mar 25, 2025 17:22:54.185653925 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-25 16:21:40 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-03-25 16:21:40 UTC	25	IN	HTTP/1.1 100 Continue
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-03-25 16:21:40 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-03-25 16:21:41 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Tue, 25 Mar 2025 16:21:41 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	16:21:25
Start date (UTC):	25/03/2025
Path:	/tmp/mips.elf
Arguments:	/tmp/mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	16:21:26
Start date (UTC):	25/03/2025
Path:	/tmp/mips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	16:21:27
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:28
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:30
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:31
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:32
Start date (UTC):	25/03/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:21:33
Start date (UTC):	25/03/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:21:34
Start date (UTC):	25/03/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:21:37
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:35
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:36
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:38
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:21:49
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6428/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:76550MD0kHk

/run/systemd/journal/streams/.#9:76551pTH24n

/run/systemd/journal/streams/.#9:76552EW9XGk

/run/systemd/journal/streams/.#9:76553KeCuZl

/run/systemd/journal/streams/.#9:76554ujUZQk

/run/systemd/journal/streams/.#9:76555jivztn

/run/systemd/journal/streams/.#9:76558yWczfl

/run/systemd/journal/streams/.#9:76565K0zwfl

/run/systemd/journal/streams/.#9:76566Qwc04j

/run/systemd/journal/streams/.#9:76575Q7ICKl

/run/systemd/journal/streams/.#9:76576FHw7Yk

/run/systemd/journal/streams/.#9:766686gusWl

/run/systemd/journal/streams/.#9:76741wXXv3j

/run/systemd/journal/streams/.#9:77118Py2kVn

/run/systemd/journal/streams/.#9:771401BLPUj

/run/systemd/journal/streams/.#9:77149P0pAql

/run/systemd/journal/streams/.#9:77170EcYUYm

/run/systemd/journal/streams/.#9:77171ImDhWk

/run/systemd/journal/streams/.#9:771870tRkfk

/run/systemd/journal/streams/.#9:77188WFWGuj

/run/systemd/journal/streams/.#9:772997lbzNl

/run/systemd/journal/streams/.#9:77322VdGU1m

Linux Analysis Report
mips.elf

Start time (UTC):	16:21:51
Start date (UTC):	25/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:21:53
Start date (UTC):	25/03/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:21:54
Start date (UTC):	25/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:21:50
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:22:56
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:22:57
Start date (UTC):	25/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre