PULSE NAME
["backup ios..."] clone by Merkd1904. User note: theres a name tagged here thats interesting
WHITE Chinese Speaking msudosos 2026-05-27 Modified: 2026-05-27
321
IOCs
HIGH VOLUME
fireeyecopyrightbase64dotnettojscriptgadgettojscriptinvokeclientinvokeserverreadhost entercommandrothnextronsandwormdetects sshgrant allprivileges onto mysqldbcreate userg rootsandworm pythonimportphpsploithostuserpasserrorestablishpecl oci8connstrcharsetfalseminertexthtmlmodulesend customswisskyclassserviceipserviceportservicedatae binshinitservice portdetectscve202140444targettargetmodejeremy brownwindows cvems officemodified rulerpermwpermpathsepstringrwxrxrxfile typesunixloginautenticationdisableldapconnectversionauthenticationldaplistnullpathelemsexecutebackdoorkingdee oayunxingkongb6oacode executionkingdee cloudstarry skyotherwisefilesetsmartdatefreadnameforcebase64decodedatasubstrarrayreaddirgetownergetgroupgetsizeforce optionfwritepermissioncheckmodediraccessfileaccessrealpathstatimmutableposixgetpwuidposixgetgrgidexplodeetcpasswdglobglobonlydiroracleloginportservicenameconnectorbasequery typemssqlfetcharraymssqlassocsolsockettimeoutrangeportminportmaxsocketcreateafinetsockstreamopentypetruetcp connectiontcp shellinputlhostnetcatlportshelldllimportpythonbackforepfinetstdoutthiswin32ldapsearchselectmysqliassocselect databasesendnewfiledns stubthird partysee manexito pipefailv systemctldevnullunknown verblicensegnu lessergeneral publicfree softwarefoundationunitslicecpuweight100tasks slicecpuweight30capev2capecuckoo websetupgreplimitnofileinstallreturnexecstartstartdescriptionruntimeroncalendardailyserviceprevent ratedelay startm poetrysigkilldescriptioncapeef usercapeg capeallowisolateyestypedbussocketmessage buslistenstreamtypenotifydescriptionuserharald sittersitterkcrashdrkonqiacceptyesdisable triggertodopreventspathpathexistsglobruntimemaxsec31runtimemaxsec30restartnodescriptionexitenvironmentfileotheroptssoundfontdescriptiongcrsshauthsockdescriptionglibpriority6killmodeprocessproxysocketmode0600apache softwarenotice fileapache licenseunlessas isbasisor conditionsapple fileconduit monitordescriptionjackjackoptions ddriver ddevicemedia transferindexer daemonmemorymemoryhigh512msystem socketsa userconditionuserdbus menusplasmaphaseworkspace coreexit statusx11 connectiontimeoutstopsec5disable restarttimeoutsec40sectypeoneshotdavid edmundsondavidedmundsonosd serviceportalauto restartdbusxembed systemlogging systemsocketmode0660all containersrestart policylogging startexecstopbinsh cloggingx11 pluginssession slicetypeforkingetc userrootgrouprootonbootsec15minplacetemporaryvolatile filesthunarsession managerwireplumberservice filexdg autostartuser dirdescriptionxfcesandboxmalwareanalysisonlinesubmitvxstreamsampledownloadtrojanaptmemoryfile scanansibpf programindicatorbpf firewallingpcappcap processingbpffallowmultibpf devicedatesuspicioushybridcryptocloseclickaprilstringsfebruarymiddleexploitgameovercontactscopethomas kochgpl v2imsmibftrulediribftrulesattrsystemd rulehannes reineckesuse labsipibftinterfacekernelconfigfiletypesimpleapparmorgrouparchaudithardeningumask077persistenttrueenable debugnetworkmanagertracewait onlineeditnotereloadcapdacoverridedhcp etcmdadmscanmdadmdelaymdadmmailmdadmprogrammdadmconfigmdadmsendmailp runsysconfiguserrootsssdwrite accessneeded sometimestatedirectoryaccountsservicevarloglastlogbridge daemonalsa cardcard staterequiredanother autonice daemonmemorymax64mfilter systemmountrebootclocklogging servicerequiresbeforepleaseexit codesprocdescriptionrunsexecstartsh cswitchtoggleignoreonisolateterm typeidlewithoutany warrantymerchantabilityfitnessa particularvartmpwants typepreparationwatchdogsec10filesystemtimer daemonoptionsenvironmentpreventreadwritepathssecuritycertainprotectsystembindpathslower cpunice19manageruserccelerydnodesinfochaddevopsaaron brightonclam antivirusjon krieldistributionscriptsanesecuritysecuriteinfomalwarepatroloitcfile locationremembertypeexec user9 cntlmgenerate colorprofilesremoveipctruedevptsauthorsany kindusercouchdbrestartsec5volumesserver socketuser209daemondarkstatifacereloadconfigwatchdogsec3minprivatetmpyesprotectprocincreasedescriptiontimedate servicedebugging onlyignoresigpipenounset localefile systemqueue filewhatmqueueoptionsnosuidpf rundhclientraterequiresdirmngrcapfownercapsetpcapdhcpdns serverstartlimitlimitsdelegateyesdescriptionpassruntimemaxsec5mountainmetadata checkall filesystemsonline metadatasundayoncalendarsunonline ext4sigterm signaljava processpiddirstandardoutputelasticsearchlimitnproc4096limitasinfinitysendsighupyesmapper daemonmainpidquitlistenstream79radius serverd etcraddbprotecthomeondefaultsystemserviceefiefi bootefiafinet afinet6afunix afinetoncalendar 0000privatetmptruegeoip legacygeoip2instanceusergitscdconfignoticedevinputmice tdescriptiongpssystemsock refclockgpsdoptionsdevicesdaemon sockets2947bindipv6onlyyesusbautousrbingpsdctlgps daemonafterdevgvmddatavarlibgssproxynonewprivilegesprivatetmpprotecthomeieeeetchostapdkillmodemixedfcopyuncommentuse sigtermsigkill i2pdsendsigkillyeslimitnofile8192systemdanalogshutting downiodineextip piodineport piodineusertuniptopdomainguessmainpidyesm nodewantsinitiatornameio drivertypeexecc etckcptunusernobodyrequireskeyboxdstatic devicenoforkrestartalwayslinker cachehackuse wantsraisetasksmaxtasksmax32768limitmemlock64mremoveonstopyesip sockettls ipconflictsgettyaftergettybusmodulesqabrhwmonmoduleslocal fileprivatenetworklvm2initializationautoboot codes delegatetruedescriptionpidfilerunlxclynis serviceadjust pathlynis binarylynis timertell systemdlynis securitypersistentfalsecontainer slicerecovervarcachemanregenerate manuserroot nice19mysqldoptsmysqldsafetimezonecorerestartusersbacklog150listenstreamsservicemariadbmechanismmariadbmulti instancevariablesbindirmdadmgnu generalpublic licensereshapeonactivesec30oncalendarwantedbymonitorallow mdmontakeoverk nonec devnulld runinitramfsp runmongodblimitnproc32000limitmemlock5device serverrequiredbydevd devdescriptionrealextraoptsrestartsec30validfifoprioritybatchnice0partoftracking daemonhelperfor testingonlyrestrictgrantcapsysptracecapkillcapipclockenvironcapsysresourcecapsyslogdescriptionnameservice cachesysvlsbdescriptionhostnetwork namegroup nameu ntptime servicet hibernatesoftwareotherthe softwaredaemon initsoftware isprovidedfcnvmewantsmodprobeaftermodprobedescriptionallnbftnvmeofconnectargsunit filedescriptionnvmfred hatwithout anywarrantycard daemonsocketmode0666suite resultkexec screenoncalendarsatboot screentimeoutsec20power offruntime datadescriptionholdtimeoutsec0sandboxingexecstopcolin waltersupgradeupgrade outputumask0077transport agentdescriptionmakedescriptionpppwhatnfsdfile formatsautomount pointautomountsetuid nobodysetgid nobodysetconsyslogrestartonaborthalt screenreboot screenpgrootpostgresqloom killeradditionalfy nice19endless osfoundation llcrestartsec0system quotasrabbitmqprotecthometrueetcratholeguessmainpidnoh etcrdnssdreflectorafinet6 afunixumask177remote filenfs clientnfsv23 lockingmake surerpc netconfigdescriptionfastusing sshso letbootrealtimekitrwhodoptsdisplay managerspecifyinterval lloginterval fbindstodevalwaysusrbingrpck rslapdoptionsu ldapslapdurlssmartpciusbmididaemonoptssnmptrap daemong snortdescriptionsudohibernatesvnserveargswhatfusectlwhatconfigfswhatdebugfswhattracefsbest waysee httpsunits serviceservice sliceoffline systemupdatewall directorytimeoutsec90sdescriptionmarkcurrent bootloader entryany systemunitsloader randomloader updateservice socketdump socketoptionallyroot deviceafalg afinetexecstophomectlhome areanamed pipesink servicesink socketupload servicedynamicuseryessigkilleddevlogtimestampingusnamespacesendbuffer8mkernel commandnetlink socketstoragedescriptionwaitnetworkmakedeviceallowreservekiller socketroot filemeasurementpcr policytpm pcrcodeconfigurationmachine idbarrierquota checksystem quotaafterrandom seedkernel filegpt partitionkill switchnvmetcptriggersaturdaypersistentyessystem updatekernel timecapsystimentp serviceturnfilesdevice nodessrk setupdevice eventsbootshutdownchangemanager socketdescriptiontincproxy serverlinrunnerdescriptiontlptor servicef etctortorrctpm devicedescriptionudptcpicmpudpetcudp2rawdebugswapapi fileprivatedeviceshomerootrunuserlinux controlgroupsgroupafnetlinklocked memorylimitmemlock0usb gadgetapplesliceuserdescriptionuuidcompatibilitytyperpcpipefsvmsvgahypervisorusr1mgmt appuserdac permissionselinuxxxx someoneqemumachine toolsvmware toolspidfilerunvpncwacomiface ddspeed uifacedescriptionwpaoraclereservedwongemailaddrtunnel protocoll2tpispsrussia useipsecd optxplicob sqlitedescriptionxrdpxrdpoptionsprocesssesmanoptionszpoolimportoptsan ot scrubusrbinzpoolzfs volumedescriptionzfsf restartalwaysremainafterexitnmbdoptionssmbdoptionssuccessactionwinbindoptionsck idhybrid analysismitre attmalicioussdshared ansidefault undfunc globalfunc localobject localgeneralshow techniqueck matrixtasksmax33empty fileproxycommandcheckhostipafunixafvsockallowr tablechkbootcheckgplv2 sourcechkbootstylesetcissuepartitionminimizebestmit nomatchlinknamepolicykeepethernet linkkindveth namevekindveth namevbkeepmasteryesdhcpv4kindsit name6rdipv4llipv6lldhcpipv6radhcpv6typeetherdhcpyesusetimezoneyestypewlantuntapnatdhcpkindtun namevtkindoriginalnamedefinedbypeersopeergroupsdbus protocoldbus nameexechup signalsighupdnssecsessionidseatidsleepleaderjobresultcoredumppidcoredumpcommjunitna zapuskmikrasiekundenhedmikrosekunderopstartjobida rendszerezredmsodperceta rendszernapluser managersmacklunitstatoil processoil sistemastatale processusnotez quejedinicazapamtite danovajednostkaprosz zauwayzwykle wskazujejesto processoprocessoissoinicializaojournalsizelimituseridprozessspeicherabbildhinweis aufprogrammfehlerfehler demdie systemzeitrealtime
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
RemainAfterExit NMBDOPTIONS SMBDOPTIONS SuccessAction WINBINDOPTIONS
Indicators of Compromise (25 / 321 total)
All FileHash-MD5 YARA CVE FileHash-SHA1 FileHash-SHA256 domain URL email hostname CIDR
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA1 0088262ccbf6a3f3710f6b80952c37ab14e211ea SHA1 of dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730 2026-05-27
FileHash-SHA1 70427d9f70306cd4e6f48ca95b786a44e237a543 SHA1 of c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca 2026-05-27
FileHash-SHA1 a32b6a75f20f0a54076e1ecdf82889d60ef75207 SHA1 of 538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e 2026-05-27
FileHash-SHA1 a60815382b152318ca94ff8dc839e14041eb7478 SHA1 of abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676 2026-05-27
FileHash-SHA1 4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9 SHA1 of 84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69 2026-05-27
FileHash-SHA1 c52ce8962faa34fac6c5c9fb3453ce9d0880f7ab SHA1 of 13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e 2026-05-27
FileHash-SHA1 3a8df73672b3178d1f1583720e84144dee22c0d8 SHA1 of e596592ce9b8a8652864f9a4d330729353157351e17fcc66fe5c3af2258ffc04 2026-05-27
FileHash-SHA1 50bf1607953ea79d1546874fce4e7e24868db3c7 SHA1 of 26e52d1fc06b80300f2af61e3bb6856c96a2c6d786966bbf1289d2c4b633ce83 2026-05-27
FileHash-SHA1 8deb90f11f3596dbbfadeaa05fd5b40567a6d60a 2026-05-27
FileHash-SHA1 b396b5de3aa5d1802e8986f4ad3a5f10d2378997 SHA1 of 671ec7ec2dafbdcb6b24cbf64263cd4dbf659bef41c575560dda74975ddc4f04 2026-05-27
FileHash-SHA1 c4350ff9b23d454ef43a70125dce4bc1b01b19c8 2026-05-27
FileHash-SHA1 d5f9c69de4d7b5705e557bac75832daa3470e636 SHA1 of 689819cfb0e30bbcd623c007313355bf442361dfda168b818f1a3b453691e19e 2026-05-27
FileHash-SHA1 fc6e054d6b8a17fbdcf3bad83a7c4fa7202bbd38 SHA1 of ebad322fd9bb8b74861fe36131eb1166fb0a8ba24cc0a0f7db62b86bb461d9cf 2026-05-27
FileHash-SHA1 00683fb98414fbe79ca5b0bf6c912083b2e8e852 SHA1 of 514d739ef92e844a370bc555e0f56381f1301992908aab936038a7a7b65f2472 2026-05-27
FileHash-SHA1 3a616cacddba89ab74e97e3c01efabc5222bee58 SHA1 of 8569772611abe3f25fe4f5d5422aad894d29705c6f97bc2a7978a1d1c1fe9b82 2026-05-27
FileHash-SHA1 4861ab61e56d8afa9185724a2444cd22598736b2 2026-05-27
FileHash-SHA1 95132175fef6f09950fb8567cebaac79139fac02 SHA1 of 03abad346c58d3670d064e5f61595367ef393f0a70ee933c21ad8b45fe37d84b 2026-05-27
FileHash-SHA1 9bb260bfec660ffb000760a61ec35e33f1664d87 2026-05-27
FileHash-SHA1 da29ceebbacf7183b7f8118528052a1e8a01d96d SHA1 of 480a42e823456e5c78348a3f85beec0d02581bbfd255dad5cb208c16862f3995 2026-05-27
FileHash-SHA1 fd64c5bf3243ccdf61ff85427d366c7f73e65b2d SHA1 of f556f38690b8b551ec8215bc38d2d1fc02895acf9ff54f9fa140ae568d296dfe 2026-05-27
FileHash-SHA1 9cc99cc689d03040023590fe66a7d08ca1fd7e5e 2026-05-27
FileHash-SHA1 e80bf88fd7ed5d2fdf43c7edeb712134e0843641 2026-05-27
FileHash-SHA1 65a85288336c6de176163748aab8fe9ccd5515b7 2026-05-27
FileHash-SHA1 bce2485dc99480b7319e809001b40588c0e8baf0 2026-05-27
FileHash-SHA1 28b5ba2aa0f55d80adb2624564ed2b170c19519e 2026-05-27
References (984)
↗ Hunting_B64Engine_DotNetToJScript_Dos.yar ↗ APT_Backdoor_PS1_BASICPIPESHELL_1.yar ↗ apt_sandworm_exim_expl.yar.002 ↗ apt_sandworm_exim_expl.yar.001 ↗ apt_sandworm_exim_expl.yar ↗ connect.php ↗ connect.php.002 ↗ connect.php.001 ↗ crypto-miner.js ↗ eicar ↗ eicar.001 ↗ eicar.002 ↗ custom.py ↗ eicar.txt ↗ expl_cve_2021_40444.yar.001 ↗ expl_cve_2021_40444.yar.002 ↗ getPerms.php ↗ input.pcap ↗ list.php ↗ parent.php ↗ payload.php ↗ payload.php.001 ↗ kingdee-erp-rce.yaml ↗ payload.php.003 ↗ payload.php.002 ↗ payload.php.004 ↗ payload.php.005 ↗ payload.php.006 ↗ payload.php.007 ↗ payload.php.008 ↗ payload.php.010 ↗ payload.php.011 ↗ payload.php.009 ↗ payload.php.012 ↗ payload.php.013 ↗ payload.php.015 ↗ payload.php.016 ↗ payload.php.017 ↗ reverse_tcp.py ↗ scanner.php ↗ search.php ↗ setdb.php ↗ payload.php.014 ↗ setdb.php.001 ↗ reader.php ↗ single.php ↗ resolv.conf ↗ systemd-update-helper ↗ 90-systemd.preset ↗ 60-flatpak ↗ app.slice ↗ background.slice ↗ README.md ↗ bluetooth.target ↗ basic.target ↗ borgmatic-user.timer ↗ borgmatic-user.service ↗ cape.service ↗ cape-dist.service ↗ cape-processor.service ↗ cape-rooter.service ↗ capsule@.target ↗ cape-web.service ↗ clash.service ↗ colord-session.service ↗ dbus.socket ↗ cape-fstab.service ↗ dbus.service ↗ dbus-broker.service ↗ dconf.service ↗ dirmngr.service ↗ default.target ↗ drkonqi-coredump-cleanup.service ↗ dirmngr.socket ↗ drkonqi-coredump-cleanup.timer ↗ drkonqi-coredump-launcher.socket ↗ drkonqi-sentry-postman.path ↗ drkonqi-coredump-pickup.service ↗ drkonqi-sentry-postman.service ↗ drkonqi-sentry-postman.timer ↗ drkonqi-coredump-launcher@.service ↗ dunst.service ↗ flatpak-oci-authenticator.service ↗ filter-chain.service ↗ exit.target ↗ flatpak-session-helper.service ↗ fluidsynth.service ↗ gcr-ssh-agent.socket ↗ flatpak-portal.service ↗ gcr-ssh-agent.service ↗ gnome-keyring-daemon.service ↗ glib-pacrunner.service ↗ gnome-keyring-daemon.socket ↗ gpg-agent-ssh.socket ↗ gnome-terminal-server.service ↗ gpg-agent-extra.socket ↗ gpg-agent.service ↗ gpg-agent.socket ↗ gpg-agent-browser.socket ↗ graphical-session-pre.target ↗ graphical-session.target ↗ gssuserproxy.socket ↗ guacd.service ↗ gvfs-gphoto2-volume-monitor.service ↗ gvfs-daemon.service ↗ gssuserproxy.service ↗ gvfs-afc-volume-monitor.service ↗ gvfs-metadata.service ↗ jack@.service ↗ guac-web.service ↗ gvfs-udisks2-volume-monitor.service ↗ gvfs-mtp-volume-monitor.service ↗ kde-baloo.service ↗ keyboxd.service ↗ kio-fuse.service ↗ keyboxd.socket ↗ p11-kit-server.service ↗ p11-kit-server.socket ↗ paths.target ↗ pipewire.socket ↗ pipewire-pulse.service ↗ plasma-gmenudbusmenuproxy.service ↗ pipewire-pulse.socket ↗ plasma-baloorunner.service ↗ plasma-kcminit.service ↗ plasma-dolphin.service ↗ plasma-kcminit-phase1.service ↗ plasma-core.target ↗ plasma-kded.service ↗ pipewire.service ↗ plasma-kded6.service ↗ plasma-kglobalaccel.service ↗ at-spi-dbus-bus.service ↗ plasma-krunner.service ↗ plasma-kscreen.service ↗ plasma-kscreen-osd.service ↗ plasma-ksmserver.service ↗ plasma-ksplash.service ↗ plasma-ksplash-ready.service ↗ plasma-ksystemstats.service ↗ plasma-kwallet-pam.service ↗ plasma-kwin_wayland.service ↗ plasma-kwin_x11.service ↗ plasma-plasmashell.service ↗ plasma-polkit-agent.service ↗ plasma-powerdevil.service ↗ plasma-powerprofile-osd.service ↗ plasma-restoresession.service ↗ plasma-workspace.target ↗ plasma-workspace-wayland.target ↗ plasma-workspace-x11.target ↗ plasma-xdg-desktop-portal-kde.service ↗ plasma-xembedsniproxy.service ↗ podman.service ↗ podman.socket ↗ podman-auto-update.service ↗ podman-auto-update.timer ↗ podman-kube@.service ↗ podman-restart.service ↗ printer.target ↗ pulseaudio.service ↗ pulseaudio.socket ↗ pulseaudio-x11.service ↗ session.slice ↗ shutdown.target ↗ smartcard.target ↗ sockets.target ↗ sound.target ↗ ssh-agent.service ↗ suricata.service ↗ suricata-update.service ↗ suricata-update.timer ↗ systemd-exit.service ↗ systemd-tmpfiles-clean.service ↗ systemd-tmpfiles-clean.timer ↗ systemd-tmpfiles-setup.service ↗ thunar.service ↗ timers.target ↗ tracker-xdg-portal-3.service ↗ tumblerd.service ↗ wireplumber.service ↗ wireplumber@.service ↗ xdg-desktop-autostart.target ↗ xdg-desktop-portal.service ↗ xdg-desktop-portal-gtk.service ↗ xdg-desktop-portal-hyprland.service ↗ xdg-desktop-portal-rewrite-launchers.service ↗ xdg-desktop-portal-xapp.service ↗ xdg-permission-store.service ↗ xdg-user-dirs-update.service ↗ xfce4-notifyd.service ↗ xsettingsd.service ↗ xdg-document-portal.service ↗ https://hybrid-analysis.com/sample/b1a9e5be43c028442c07071e202f44f33e3a2df167822c5cfed8f998e01fe169/661da09794b343782806018e ↗ defaults.conf ↗ apparmor.conf ↗ nvidia ↗ tlp ↗ fwupd.shutdown ↗ mdadm.shutdown ↗ 99-default.preset ↗ 50-zfs.preset ↗ ibft-rule-generator ↗ 10-arch ↗ 60-flatpak-system-only ↗ 3proxy.service ↗ apache-tika.service ↗ apparmor.service ↗ arch-audit.service ↗ arch-audit.timer ↗ NetworkManager-dispatcher.service ↗ NetworkManager-wait-online.service ↗ NetworkManager.service ↗ SUSE-mdadm_env.sh ↗ ModemManager.service ↗ 3proxy.conf ↗ archlinux-keyring-wkd-sync.service ↗ adsl.service ↗ accounts-daemon.service ↗ adb.service ↗ alsa-restore.service ↗ alsa-state.service ↗ archlinux-keyring-wkd-sync.timer ↗ ananicy-cpp.service ↗ arcolinux-graphical-target.service ↗ atftpd.service ↗ audit-rules.service ↗ auditd.service ↗ auth-rpcgss-module.service ↗ autorandr.service ↗ autorandr-lid-listener.service ↗ autovt@.service ↗ avahi-daemon.service ↗ avahi-daemon.socket ↗ avahi-dnsconfd.service ↗ bettercap.service ↗ betterlockscreen@.service ↗ blk-availability.service ↗ blockdev@.target ↗ bluetooth.service ↗ bmc-watchdog.service ↗ bolt.service ↗ boot-complete.target ↗ borgmatic.service ↗ borgmatic.timer ↗ bpftune.service ↗ btrfs-scrub@.service ↗ btrfs-scrub@.timer ↗ canberra-system-bootup.service ↗ canberra-system-shutdown.service ↗ canberra-system-shutdown-reboot.service ↗ capsule.slice ↗ capsule@.service ↗ celery2@.service ↗ celery@.service ↗ chkboot.service ↗ clamav-clamonacc.service ↗ clamav-daemon.service ↗ clamav-daemon.socket ↗ clamav-freshclam.service ↗ clamav-freshclam-once.service ↗ clamav-freshclam-once.timer ↗ clamav-unofficial-sigs.service ↗ clamav-unofficial-sigs.timer ↗ clash@.service ↗ cntlm.service ↗ colord.service ↗ configure-printer@.service ↗ console-getty.service ↗ container-getty@.service ↗ containerd.service ↗ couchdb.service ↗ cpupower.service ↗ create_ap.service ↗ cronie.service ↗ cryptsetup.target ↗ cryptsetup-pre.target ↗ ctrl-alt-del.target ↗ cups.path ↗ cups.service ↗ cups.socket ↗ cups-lpd.socket ↗ cups-lpd@.service ↗ cxl-monitor.service ↗ darkstat.service ↗ daxdev-reconfigure@.service ↗ dbus-org.freedesktop.hostname1.service ↗ dbus-org.freedesktop.import1.service ↗ dbus-org.freedesktop.locale1.service ↗ dbus-org.freedesktop.login1.service ↗ dbus-org.freedesktop.machine1.service ↗ dbus-org.freedesktop.portable1.service ↗ dbus-org.freedesktop.timedate1.service ↗ debug-shell.service ↗ dev-hugepages.mount ↗ dev-mqueue.mount ↗ dhclient@.service ↗ dhcpd4.service ↗ dhcpd6.service ↗ dirmngr@.service ↗ dirmngr@.socket ↗ dm-event.service ↗ dm-event.socket ↗ dmraid.service ↗ dnscrypt-proxy.service ↗ dnsmasq.service ↗ docker.service ↗ docker.socket ↗ drkonqi-coredump-processor@.service ↗ e2scrub@.service ↗ e2scrub_all.service ↗ e2scrub_all.timer ↗ e2scrub_fail@.service ↗ e2scrub_reap.service ↗ ead.service ↗ elasticsearch.service ↗ elasticsearch-keystore.service ↗ elasticsearch-keystore@.service ↗ elasticsearch@.service ↗ emergency.service ↗ emergency.target ↗ epmd.service ↗ epmd.socket ↗ exabgp.service ↗ factory-reset.target ↗ fancontrol.service ↗ fastnetmon.service ↗ final.target ↗ finger.socket ↗ finger@.service ↗ first-boot-complete.target ↗ flatpak-system-helper.service ↗ freeradius.service ↗ fsidd.service ↗ fstrim.service ↗ fstrim.timer ↗ ftpd.service ↗ fwupd.service ↗ fwupd-offline-update.service ↗ fwupd-refresh.service ↗ fwupd-refresh.timer ↗ geoclue.service ↗ geoipupdate.service ↗ geoipupdate.timer ↗ getty.target ↗ getty-pre.target ↗ getty@.service ↗ git-daemon.socket ↗ git-daemon@.service ↗ gnupg-pkcs11-scd-proxy.service ↗ gpg-agent-browser@.socket ↗ gpg-agent-extra@.socket ↗ gpg-agent-ssh@.socket ↗ gpg-agent@.service ↗ gpg-agent@.socket ↗ gpm.path ↗ gpm.service ↗ gpsd.service ↗ gpsd.socket ↗ gpsdctl@.service ↗ graphical.target ↗ greenbone-certdata-sync.service ↗ greenbone-certdata-sync.timer ↗ greenbone-feed-sync.service ↗ greenbone-feed-sync.timer ↗ greenbone-nvt-sync.service ↗ greenbone-nvt-sync.timer ↗ greenbone-scapdata-sync.service ↗ greenbone-scapdata-sync.timer ↗ gssproxy.service ↗ gvmd.service ↗ halt.target ↗ healthd.service ↗ hibernate.target ↗ hostapd.service ↗ hostapd@.service ↗ httpd.service ↗ hv_fcopy_daemon.service ↗ hv_kvp_daemon.service ↗ hv_vss_daemon.service ↗ hybrid-sleep.target ↗ i2pd.service ↗ iiod.service ↗ initrd.target ↗ initrd-cleanup.service ↗ initrd-fs.target ↗ initrd-parse-etc.service ↗ initrd-root-device.target ↗ initrd-root-fs.target ↗ initrd-switch-root.service ↗ initrd-switch-root.target ↗ initrd-udevadm-cleanup-db.service ↗ initrd-usr-fs.target ↗ integritysetup.target ↗ integritysetup-pre.target ↗ iodined.service ↗ iodined.socket ↗ ip2clued.service ↗ ip6tables.service ↗ ipmidetectd.service ↗ ipmiseld.service ↗ iptables.service ↗ iscsi.service ↗ iscsi-init.service ↗ iscsid.service ↗ iscsid.socket ↗ iscsiuio.service ↗ iscsiuio.socket ↗ isnsd.service ↗ isnsd.socket ↗ iwd.service ↗ kcptun-server@.service ↗ kcptun@.service ↗ kexec.target ↗ keyboxd@.service ↗ keyboxd@.socket ↗ kmod-static-nodes.service ↗ krb5-kadmind.service ↗ krb5-kdc.service ↗ krb5-kpropd.service ↗ krb5-kpropd.socket ↗ krb5-kpropd@.service ↗ lastlog2-import.service ↗ ldconfig.service ↗ libvirt-guests.service ↗ libvirtd.service ↗ libvirtd.socket ↗ libvirtd-admin.socket ↗ libvirtd-ro.socket ↗ libvirtd-tcp.socket ↗ libvirtd-tls.socket ↗ lightdm.service ↗ lm_sensors.service ↗ local-fs.target ↗ local-fs-pre.target ↗ logrotate.service ↗ logrotate.timer ↗ lvm2-lvmpolld.service ↗ lvm2-lvmpolld.socket ↗ lvm2-monitor.service ↗ lxc.service ↗ lxc-auto.service ↗ lxc-monitord.service ↗ lxc-net.service ↗ lxc@.service ↗ lxdm.service ↗ ly.service ↗ lynis.service ↗ lynis.timer ↗ machine.slice ↗ machines.target ↗ man-db.service ↗ man-db.timer ↗ mariadb.service ↗ mariadb.socket ↗ mariadb-extra.socket ↗ mariadb-extra@.socket ↗ mariadb@.service ↗ mariadb@.socket ↗ mdadm-grow-continue@.service ↗ mdadm-last-resort@.service ↗ mdadm-last-resort@.timer ↗ mdcheck_continue.service ↗ mdcheck_continue.timer ↗ mdcheck_start.service ↗ mdcheck_start.timer ↗ mdmon@.service ↗ mdmonitor.service ↗ mdmonitor-oneshot.service ↗ mdmonitor-oneshot.timer ↗ memavaild.service ↗ mkinitcpio-generate-shutdown-ramfs.service ↗ modprobe@.service ↗ mongodb.service ↗ multi-user.target ↗ mysql.service ↗ mysqld.service ↗ named.service ↗ nbd.service ↗ nbd@.service ↗ ndctl-monitor.service ↗ neo4j.service ↗ netavark-dhcp-proxy.service ↗ netavark-dhcp-proxy.socket ↗ netdata.service ↗ network.target ↗ network-online.target ↗ network-pre.target ↗ nfs-blkmap.service ↗ nfs-client.target ↗ nfs-idmapd.service ↗ nfs-mountd.service ↗ nfs-server.service ↗ nfs-utils.service ↗ nfsdcld.service ↗ nfsv4-exportd.service ↗ nfsv4-server.service ↗ nftables.service ↗ nm-priv-helper.service ↗ nmb.service ↗ nohang.service ↗ nohang-desktop.service ↗ nscd.service ↗ nss-lookup.target ↗ nss-user-lookup.target ↗ ntpd.service ↗ ntpdate.service ↗ nvidia-hibernate.service ↗ nvidia-persistenced.service ↗ nvidia-powerd.service ↗ nvidia-resume.service ↗ nvidia-suspend.service ↗ nvmefc-boot-connections.service ↗ nvmf-autoconnect.service ↗ nvmf-connect.target ↗ nvmf-connect-nbft.service ↗ nvmf-connect@.service ↗ pacrunner.service ↗ ostree-boot-complete.service ↗ pacman-filesdb-refresh.timer ↗ pcscd.service ↗ passim.service ↗ pcscd.socket ↗ packagekit-offline-update.service ↗ phoronix-result-server.service ↗ paccache.timer ↗ plymouth-kexec.service ↗ pamac-cleancache.timer ↗ plymouth-quit.service ↗ partimaged.service ↗ plymouth-poweroff.service ↗ plymouth-read-write.service ↗ plymouth-quit-wait.service ↗ paccache.service ↗ plymouth-switch-root-initramfs.service ↗ ostree-remount.service ↗ plymouth-switch-root.service ↗ openvpn-client@.service ↗ podman-clean-transient.service ↗ pamac-offline-upgrade.service ↗ polkit.service ↗ postfix.service ↗ pam_namespace.service ↗ poweroff.target ↗ ppp@.service ↗ opensnitchd.service ↗ proc-fs-nfsd.mount ↗ proc-sys-fs-binfmt_misc.automount ↗ proc-sys-fs-binfmt_misc.mount ↗ phoromatic-server.service ↗ ptunnel.service ↗ openvpn-server@.service ↗ plymouth-halt.service ↗ pamac-cleancache.service ↗ plymouth-reboot.service ↗ ostree-state-overlay@.service ↗ ostree-finalize-staged.service ↗ postgresql.service ↗ phoromatic-client.service ↗ pamac-daemon.service ↗ pacman-filesdb-refresh.service ↗ packagekit.service ↗ pkgfile-update.service ↗ pkgfile-update.timer ↗ plymouth-start.service ↗ ostree-prepare-root.service ↗ ostree-finalize-staged.path ↗ privoxy.service ↗ ostree-finalize-staged-hold.service ↗ qemu-guest-agent.service ↗ quotaon.service ↗ quotaon-root.service ↗ quotaon@.service ↗ rabbitmq.service ↗ ras-mc-ctl.service ↗ rasdaemon.service ↗ rathole@.service ↗ ratholec@.service ↗ ratholes@.service ↗ rc-local.service ↗ rdnssd@.service ↗ reboot.target ↗ redis.service ↗ redis-sentinel.service ↗ reflector.service ↗ reflector.timer ↗ remote-cryptsetup.target ↗ remote-fs.target ↗ remote-fs-pre.target ↗ remote-veritysetup.target ↗ rescue.service ↗ rescue.target ↗ rfkill-block@.service ↗ rfkill-unblock@.service ↗ rlogin.socket ↗ rlogin@.service ↗ rpc-gssd.service ↗ rpc-statd.service ↗ rpc-statd-notify.service ↗ rpc_pipefs.target ↗ rpcbind.service ↗ rpcbind.socket ↗ rpcbind.target ↗ rsh.socket ↗ rsh@.service ↗ rsyncd.service ↗ rsyncd.socket ↗ rsyncd@.service ↗ rtkit-daemon.service ↗ runlevel0.target ↗ runlevel1.target ↗ runlevel2.target ↗ runlevel3.target ↗ runlevel4.target ↗ runlevel5.target ↗ runlevel6.target ↗ rwhod.service ↗ samba.service ↗ sddm.service ↗ seatd.service ↗ sensord.service ↗ serial-getty@.service ↗ shadow.service ↗ shadow.timer ↗ sigpwr.target ↗ slapd.service ↗ sleep.target ↗ slices.target ↗ smartd.service ↗ smb.service ↗ sndiod.service ↗ snmpd.service ↗ snmptrapd.service ↗ snort@.service ↗ snort@1000.service ↗ soft-reboot.target ↗ ssh-access.target ↗ sshd.service ↗ sshdgenkeys.service ↗ sshuttle.service ↗ sslh.service ↗ sslh-fork.service ↗ sslh-select.service ↗ storage-target-mode.target ↗ stunnel.service ↗ sudo_logsrvd.service ↗ suspend.target ↗ suspend-then-hibernate.target ↗ svnserve.service ↗ swap.target ↗ sys-fs-fuse-connections.mount ↗ sys-kernel-config.mount ↗ sys-kernel-debug.mount ↗ sys-kernel-tracing.mount ↗ sysinit.target ↗ syslog.socket ↗ system-systemd\x2dcryptsetup.slice ↗ system-systemd\x2dveritysetup.slice ↗ system-update.target ↗ system-update-cleanup.service ↗ system-update-pre.target ↗ systemd-ask-password-console.path ↗ systemd-ask-password-console.service ↗ systemd-ask-password-plymouth.path ↗ systemd-ask-password-plymouth.service ↗ systemd-ask-password-wall.path ↗ systemd-ask-password-wall.service ↗ systemd-backlight@.service ↗ systemd-battery-check.service ↗ systemd-binfmt.service ↗ systemd-bless-boot.service ↗ systemd-boot-check-no-failures.service ↗ systemd-boot-random-seed.service ↗ systemd-boot-update.service ↗ systemd-bootctl.socket ↗ systemd-bootctl@.service ↗ systemd-bsod.service ↗ systemd-confext.service ↗ systemd-coredump.socket ↗ systemd-coredump@.service ↗ systemd-creds.socket ↗ systemd-creds@.service ↗ systemd-firstboot.service ↗ systemd-fsck-root.service ↗ systemd-fsck@.service ↗ systemd-growfs-root.service ↗ systemd-growfs@.service ↗ systemd-halt.service ↗ systemd-hibernate.service ↗ systemd-hibernate-resume.service ↗ systemd-homed.service ↗ systemd-homed-activate.service ↗ systemd-homed-firstboot.service ↗ systemd-hostnamed.service ↗ systemd-hostnamed.socket ↗ systemd-hwdb-update.service ↗ systemd-hybrid-sleep.service ↗ systemd-importd.service ↗ systemd-initctl.service ↗ systemd-initctl.socket ↗ systemd-journal-catalog-update.service ↗ systemd-journal-flush.service ↗ systemd-journal-gatewayd.service ↗ systemd-journal-gatewayd.socket ↗ systemd-journal-remote.service ↗ systemd-journal-remote.socket ↗ systemd-journal-upload.service ↗ systemd-journald.service ↗ systemd-journald.socket ↗ systemd-journald-audit.socket ↗ systemd-journald-dev-log.socket ↗ systemd-journald-varlink@.socket ↗ systemd-journald@.service ↗ systemd-journald@.socket ↗ systemd-kexec.service ↗ systemd-localed.service ↗ systemd-logind.service ↗ systemd-machine-id-commit.service ↗ systemd-machined.service ↗ systemd-modules-load.service ↗ systemd-network-generator.service ↗ systemd-networkd.service ↗ systemd-networkd.socket ↗ systemd-networkd-persistent-storage.service ↗ systemd-networkd-wait-online.service ↗ systemd-networkd-wait-online@.service ↗ systemd-nspawn@.service ↗ systemd-oomd.service ↗ systemd-oomd.socket ↗ systemd-pcrextend.socket ↗ systemd-pcrextend@.service ↗ systemd-pcrfs-root.service ↗ systemd-pcrfs@.service ↗ systemd-pcrlock.socket ↗ systemd-pcrlock-file-system.service ↗ systemd-pcrlock-firmware-code.service ↗ systemd-pcrlock-firmware-config.service ↗ systemd-pcrlock-machine-id.service ↗ systemd-pcrlock-make-policy.service ↗ systemd-pcrlock-secureboot-authority.service ↗ systemd-pcrlock-secureboot-policy.service ↗ systemd-pcrlock@.service ↗ systemd-pcrmachine.service ↗ systemd-pcrphase.service ↗ systemd-pcrphase-initrd.service ↗ systemd-pcrphase-sysinit.service ↗ systemd-portabled.service ↗ systemd-poweroff.service ↗ systemd-pstore.service ↗ systemd-quotacheck.service ↗ systemd-quotacheck-root.service ↗ systemd-quotacheck@.service ↗ systemd-random-seed.service ↗ systemd-reboot.service ↗ systemd-remount-fs.service ↗ systemd-repart.service ↗ systemd-resolved.service ↗ systemd-rfkill.service ↗ systemd-rfkill.socket ↗ systemd-soft-reboot.service ↗ systemd-storagetm.service ↗ systemd-suspend.service ↗ systemd-suspend-then-hibernate.service ↗ systemd-sysctl.service ↗ systemd-sysext.service ↗ systemd-sysext.socket ↗ systemd-sysext@.service ↗ systemd-sysupdate.service ↗ systemd-sysupdate.timer ↗ systemd-sysupdate-reboot.service ↗ systemd-sysupdate-reboot.timer ↗ systemd-sysusers.service ↗ systemd-time-wait-sync.service ↗ systemd-timedated.service ↗ systemd-timesyncd.service ↗ systemd-tmpfiles-setup-dev.service ↗ systemd-tmpfiles-setup-dev-early.service ↗ systemd-tpm2-setup.service ↗ systemd-tpm2-setup-early.service ↗ systemd-udev-trigger.service ↗ systemd-udevd.service ↗ systemd-udevd-control.socket ↗ systemd-udevd-kernel.socket ↗ systemd-update-done.service ↗ systemd-update-utmp.service ↗ systemd-update-utmp-runlevel.service ↗ systemd-user-sessions.service ↗ systemd-userdbd.service ↗ systemd-userdbd.socket ↗ systemd-vconsole-setup.service ↗ systemd-vmspawn@.service ↗ systemd-volatile-root.service ↗ systemd-zram-setup@.service ↗ talk.service ↗ talk.socket ↗ teamd@.service ↗ telnet.socket ↗ telnet@.service ↗ time-set.target ↗ time-sync.target ↗ tinc.service ↗ tinc@.service ↗ tinyproxy.service ↗ tlp.service ↗ tmp.mount ↗ tor.service ↗ tpm2.target ↗ udisks2.service ↗ udp2raw@.service ↗ ufw.service ↗ uksmd.service ↗ umount.target ↗ unbound.service ↗ updatedb.service ↗ updatedb.timer ↗ upower.service ↗ usb-gadget.target ↗ usb_modeswitch@.service ↗ usbipd.service ↗ usbmuxd.service ↗ user.slice ↗ user-runtime-dir@.service ↗ user@.service ↗ uuidd.service ↗ uuidd.socket ↗ var-lib-machines.mount ↗ var-lib-nfs-rpc_pipefs.mount ↗ vboxdrmclient.path ↗ vboxdrmclient.service ↗ vboxservice.service ↗ veritysetup.target ↗ veritysetup-pre.target ↗ virt-guest-shutdown.target ↗ virtchd.service ↗ virtchd.socket ↗ virtchd-admin.socket ↗ virtchd-ro.socket ↗ virtinterfaced.service ↗ virtinterfaced.socket ↗ virtinterfaced-admin.socket ↗ virtinterfaced-ro.socket ↗ virtlockd.service ↗ virtlockd.socket ↗ virtlockd-admin.socket ↗ virtlogd.service ↗ virtlogd.socket ↗ virtlogd-admin.socket ↗ virtlxcd.service ↗ virtlxcd.socket ↗ virtlxcd-admin.socket ↗ virtlxcd-ro.socket ↗ virtnetworkd.service ↗ virtnetworkd.socket ↗ virtnetworkd-admin.socket ↗ virtnetworkd-ro.socket ↗ virtnodedevd.service ↗ virtnodedevd.socket ↗ virtnodedevd-admin.socket ↗ virtnodedevd-ro.socket ↗ virtnwfilterd.service ↗ virtnwfilterd.socket ↗ virtnwfilterd-admin.socket ↗ virtnwfilterd-ro.socket ↗ virtproxyd.service ↗ virtproxyd.socket ↗ virtproxyd-admin.socket ↗ virtproxyd-ro.socket ↗ virtproxyd-tcp.socket ↗ virtproxyd-tls.socket ↗ virtqemud.service ↗ virtqemud.socket ↗ virtqemud-admin.socket ↗ virtqemud-ro.socket ↗ virtsecretd.service ↗ virtsecretd.socket ↗ virtsecretd-admin.socket ↗ virtsecretd-ro.socket ↗ virtstoraged.service ↗ virtstoraged.socket ↗ virtstoraged-admin.socket ↗ virtstoraged-ro.socket ↗ virtvboxd.service ↗ virtvboxd.socket ↗ virtvboxd-admin.socket ↗ virtvboxd-ro.socket ↗ vmtoolsd.service ↗ vmware-vmblock-fuse.service ↗ vpnc@.service ↗ wacom-inputattach@.service ↗ wg-quick.target ↗ wg-quick@.service ↗ winbind.service ↗ wondershaper.service ↗ wpa_supplicant.service ↗ wpa_supplicant-nl80211@.service ↗ wpa_supplicant-wired@.service ↗ wpa_supplicant@.service ↗ xfs_scrub@.service ↗ xfs_scrub_all.service ↗ xfs_scrub_all.timer ↗ xfs_scrub_fail@.service ↗ xl2tpd.service ↗ xplico.service ↗ xrdp.service ↗ xrdp-sesman.service ↗ yate.service ↗ zfs.target ↗ zfs-import.service ↗ zfs-import.target ↗ zfs-import-cache.service ↗ zfs-import-scan.service ↗ zfs-load-key.service ↗ zfs-mount.service ↗ zfs-scrub-monthly@.timer ↗ zfs-scrub-weekly@.timer ↗ zfs-scrub@.service ↗ zfs-share.service ↗ zfs-trim-monthly@.timer ↗ zfs-trim-weekly@.timer ↗ zfs-trim@.service ↗ zfs-volume-wait.service ↗ zfs-volumes.target ↗ zfs-zed.service ↗ plymouth.conf ↗ gpg-agent-ssh@etc-pacman.d-gnupg.socket ↗ keyboxd@etc-pacman.d-gnupg.socket ↗ dirmngr@etc-pacman.d-gnupg.socket ↗ gpg-agent-browser@etc-pacman.d-gnupg.socket ↗ gpg-agent-extra@etc-pacman.d-gnupg.socket ↗ gpg-agent@etc-pacman.d-gnupg.socket ↗ https://hybrid-analysis.com/sample/ff42428f0fcc346cc56e2b00d4b5c4bd43b55f3465b4ccab0efba9c88f4a1c03/661da0b063c895fc2d0a78dc ↗ https://hybrid-analysis.com/sample/9613dee39157b5f9935436b36647047e267b7c10fa4c7ab1fd995db681e58c12/661da5b202eaca78740cf4ed ↗ https://hybrid-analysis.com/sample/479a0170df010c5eb742ff1b8740a2ccf381df44c8a919c95d6e38685278e78a/661da5c768340c1e25092cb2 ↗ 50-rc_keymap.conf ↗ 10-defaults.conf ↗ 10-login-barrier.conf ↗ 20-systemd-userdb.conf ↗ 20-systemd-ssh-proxy.conf ↗ iptables-flush ↗ cpupower ↗ chkboot-bootcheck ↗ 10-root.conf ↗ 30-root-verity-sig.conf ↗ 20-root-verity.conf ↗ 80-systemd-timesync.list ↗ 80-6rd-tunnel.link ↗ 80-container-ve.network ↗ 80-container-vb.network ↗ 80-container-vz.link ↗ 80-6rd-tunnel.network ↗ 80-container-vz.network ↗ 80-auto-link-local.network.example ↗ 80-ethernet.network.example ↗ 80-container-host0.network ↗ 80-iwd.link ↗ 80-container-vb.link ↗ 80-vm-vt.link ↗ 80-vm-vt.network ↗ 80-wifi-adhoc.network ↗ 80-wifi-ap.network.example ↗ 80-wifi-station.network.example ↗ 80-container-ve.link ↗ 89-ethernet.network.example ↗ 99-default.link ↗ dbus-broker.catalog ↗ dbus-broker-launch.catalog ↗ systemd.be.catalog ↗ systemd.be@latin.catalog ↗ systemd.da.catalog ↗ systemd.bg.catalog ↗ systemd.hu.catalog ↗ systemd.catalog ↗ systemd.it.catalog ↗ systemd.fr.catalog ↗ systemd.ko.catalog ↗ systemd.hr.catalog ↗ systemd.pl.catalog ↗ systemd.pt_BR.catalog ↗ systemd.ru.catalog ↗ systemd.sr.catalog ↗ systemd.zh_CN.catalog ↗ systemd.de.catalog ↗ systemd.zh_TW.catalog ↗ expl_cve_2021_40444.yar