Potential false positives

[mira-miracoli]

Bug description:
walle ran with the following args on cron:

BASH_ENV=/opt/galaxy/.bashrc bash -c "  source /opt/galaxy/venv/bin/activate; /opt/galaxy/venv/bin/python  /usr/local/sbin/walle.py  --tool interactive    --max-size 10   --since 24     --delete-user HIGH

to test it, I created an account, started a jupyter notebook and downloaded xmrig linux stable which has a signature in intergalactic-most-wanted-list.
Instead of just deleting this test account, it also deleted another account, one of a user who's account is >2 years old and frequently used. I checked the logs and from what I saw it was impossible that this user (or someone who hacked their account) downloaded malware in the interactive tool they were running. Because the IT was not even accessed after it started.

My suspicion is that, despite all manual testing, the hashing function is faulty.