Edit tour

Linux Analysis Report
Aqua.x86-20240507-1844.elf

Overview

General Information

Sample name:	Aqua.x86-20240507-1844.elf
Analysis ID:	1437719
MD5:	7a5c8222fbb9db66a2022383049feb75
SHA1:	37bda45a0588e62524ff9ef5eff0ce7c40f48935
SHA256:	d5735eeba77fd0cb5f71a458528b8b9e0ca6055b9bfc1c5ee457fc3a760320b0
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Queries the IP of a very long domain name

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437719
Start date and time:	2024-05-07 20:45:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.x86-20240507-1844.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/215@11/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: Aqua.x86-20240507-1844.elf

Runtime Messages

Command:	/tmp/Aqua.x86-20240507-1844.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.x86-20240507-1844.elf (PID: 5432, Parent: 5358, MD5: 7a5c8222fbb9db66a2022383049feb75) Arguments: /tmp/Aqua.x86-20240507-1844.elf

Aqua.x86-20240507-1844.elf New Fork (PID: 5433, Parent: 5432)

Aqua.x86-20240507-1844.elf New Fork (PID: 5434, Parent: 5433)

gnome-session-binary New Fork (PID: 5435, Parent: 1588)

sh (PID: 5435, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5435, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5440, Parent: 1)

systemd-hostnamed (PID: 5440, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5569, Parent: 1400)

Default (PID: 5569, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5573, Parent: 1400)

Default (PID: 5573, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5603, Parent: 1)

dbus-daemon (PID: 5603, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5606, Parent: 1)

rsyslogd (PID: 5606, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5607, Parent: 2935)

pulseaudio (PID: 5607, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5614, Parent: 1)

systemd-logind (PID: 5614, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5676, Parent: 1)

rtkit-daemon (PID: 5676, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5679, Parent: 1)

polkitd (PID: 5679, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gvfsd-fuse New Fork (PID: 5680, Parent: 3122)

fusermount (PID: 5680, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5688, Parent: 1)

agetty (PID: 5688, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5689, Parent: 1400)

Default (PID: 5689, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5690, Parent: 1)

dbus-daemon (PID: 5690, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5691, Parent: 1)

rsyslogd (PID: 5691, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5692, Parent: 1)

gpu-manager (PID: 5692, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5698, Parent: 5692)

sh (PID: 5698, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5699, Parent: 5698)

grep (PID: 5699, Parent: 5698, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5700, Parent: 5692)

sh (PID: 5700, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5701, Parent: 5700)

grep (PID: 5701, Parent: 5700, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5702, Parent: 5692)

sh (PID: 5702, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5703, Parent: 5702)

grep (PID: 5703, Parent: 5702, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5764, Parent: 5692)

sh (PID: 5764, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5765, Parent: 5764)

grep (PID: 5765, Parent: 5764, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5766, Parent: 5692)

sh (PID: 5766, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5769, Parent: 5766)

grep (PID: 5769, Parent: 5766, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5774, Parent: 5692)

sh (PID: 5774, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5777, Parent: 5774)

grep (PID: 5777, Parent: 5774, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5778, Parent: 5692)

sh (PID: 5778, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5779, Parent: 5778)

grep (PID: 5779, Parent: 5778, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5780, Parent: 5692)

sh (PID: 5780, Parent: 5692, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5781, Parent: 5780)

grep (PID: 5781, Parent: 5780, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5696, Parent: 1)

agetty (PID: 5696, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5697, Parent: 2935)

pulseaudio (PID: 5697, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5704, Parent: 1)

rtkit-daemon (PID: 5704, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5707, Parent: 1)

systemd-logind (PID: 5707, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5770, Parent: 1)

polkitd (PID: 5770, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5782, Parent: 1)

generate-config (PID: 5782, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5783, Parent: 5782)

pkill (PID: 5783, Parent: 5782, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5786, Parent: 2935)

dbus-daemon (PID: 5786, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5787, Parent: 1)

gdm-wait-for-drm (PID: 5787, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5792, Parent: 1)

dbus-daemon (PID: 5792, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5813, Parent: 1)

rsyslogd (PID: 5813, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5816, Parent: 1)

systemd-logind (PID: 5816, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5877, Parent: 2935)

pulseaudio (PID: 5877, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5878, Parent: 1)

rtkit-daemon (PID: 5878, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5881, Parent: 1)

polkitd (PID: 5881, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5885, Parent: 1)

journalctl (PID: 5885, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5886, Parent: 1)

systemd-journald (PID: 5886, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5889, Parent: 1)

journalctl (PID: 5889, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 5891, Parent: 1)

rsyslogd (PID: 5891, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5894, Parent: 1)

systemd-logind (PID: 5894, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5951, Parent: 1)

agetty (PID: 5951, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5955, Parent: 1)

dbus-daemon (PID: 5955, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5956, Parent: 2935)

pulseaudio (PID: 5956, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5957, Parent: 1)

gpu-manager (PID: 5957, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5958, Parent: 5957)

sh (PID: 5958, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5959, Parent: 5958)

grep (PID: 5959, Parent: 5958, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5960, Parent: 5957)

sh (PID: 5960, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5962, Parent: 5960)

grep (PID: 5962, Parent: 5960, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5963, Parent: 5957)

sh (PID: 5963, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5964, Parent: 5963)

grep (PID: 5964, Parent: 5963, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5966, Parent: 5957)

sh (PID: 5966, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5967, Parent: 5966)

grep (PID: 5967, Parent: 5966, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5969, Parent: 5957)

sh (PID: 5969, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5970, Parent: 5969)

grep (PID: 5970, Parent: 5969, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5973, Parent: 5957)

sh (PID: 5973, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5975, Parent: 5973)

grep (PID: 5975, Parent: 5973, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5979, Parent: 5957)

sh (PID: 5979, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5980, Parent: 5979)

grep (PID: 5980, Parent: 5979, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5983, Parent: 5957)

sh (PID: 5983, Parent: 5957, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5984, Parent: 5983)

grep (PID: 5984, Parent: 5983, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5961, Parent: 1)

journalctl (PID: 5961, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5965, Parent: 1)

systemd-journald (PID: 5965, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5968, Parent: 1)

rtkit-daemon (PID: 5968, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5974, Parent: 1)

polkitd (PID: 5974, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5985, Parent: 1)

generate-config (PID: 5985, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5986, Parent: 5985)

pkill (PID: 5986, Parent: 5985, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5987, Parent: 1)

rsyslogd (PID: 5987, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5988, Parent: 1)

dbus-daemon (PID: 5988, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5989, Parent: 2935)

pulseaudio (PID: 5989, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5993, Parent: 1)

rtkit-daemon (PID: 5993, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5996, Parent: 1)

systemd-logind (PID: 5996, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6055, Parent: 1)

polkitd (PID: 6055, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6061, Parent: 1)

gdm-wait-for-drm (PID: 6061, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6062, Parent: 1)

journalctl (PID: 6062, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6067, Parent: 2935)

dbus-daemon (PID: 6067, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6071, Parent: 1)

rsyslogd (PID: 6071, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6072, Parent: 1)

dbus-daemon (PID: 6072, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6078, Parent: 2935)

pulseaudio (PID: 6078, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6079, Parent: 1)

journalctl (PID: 6079, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6080, Parent: 1)

systemd-journald (PID: 6080, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6083, Parent: 1)

systemd-logind (PID: 6083, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6140, Parent: 1)

agetty (PID: 6140, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6141, Parent: 1)

rsyslogd (PID: 6141, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6142, Parent: 1)

dbus-daemon (PID: 6142, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6146, Parent: 1)

gpu-manager (PID: 6146, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6147, Parent: 6146)

sh (PID: 6147, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6148, Parent: 6147)

grep (PID: 6148, Parent: 6147, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6149, Parent: 6146)

sh (PID: 6149, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6150, Parent: 6149)

grep (PID: 6150, Parent: 6149, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6151, Parent: 6146)

sh (PID: 6151, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6152, Parent: 6151)

grep (PID: 6152, Parent: 6151, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6153, Parent: 6146)

sh (PID: 6153, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6154, Parent: 6153)

grep (PID: 6154, Parent: 6153, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6155, Parent: 6146)

sh (PID: 6155, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6156, Parent: 6155)

grep (PID: 6156, Parent: 6155, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6159, Parent: 6146)

sh (PID: 6159, Parent: 6146, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 6157, Parent: 1)

rsyslogd (PID: 6157, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6158, Parent: 1)

dbus-daemon (PID: 6158, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6162, Parent: 1)

generate-config (PID: 6162, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6163, Parent: 6162)

pkill (PID: 6163, Parent: 6162, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6169, Parent: 1)

systemd-logind (PID: 6169, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6226, Parent: 1)

journalctl (PID: 6226, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6228, Parent: 1)

gdm-wait-for-drm (PID: 6228, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6234, Parent: 1)

rsyslogd (PID: 6234, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6235, Parent: 1)

dbus-daemon (PID: 6235, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6239, Parent: 1)

journalctl (PID: 6239, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6240, Parent: 1)

systemd-journald (PID: 6240, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6243, Parent: 1)

systemd-logind (PID: 6243, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6300, Parent: 1)

agetty (PID: 6300, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6301, Parent: 1)

rsyslogd (PID: 6301, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6302, Parent: 1)

dbus-daemon (PID: 6302, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6306, Parent: 1)

gpu-manager (PID: 6306, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6307, Parent: 6306)

sh (PID: 6307, Parent: 6306, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6308, Parent: 6307)

grep (PID: 6308, Parent: 6307, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6311, Parent: 6306)

sh (PID: 6311, Parent: 6306, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6312, Parent: 6311)

grep (PID: 6312, Parent: 6311, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6313, Parent: 6306)

sh (PID: 6313, Parent: 6306, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6314, Parent: 6313)

grep (PID: 6314, Parent: 6313, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6317, Parent: 6306)

sh (PID: 6317, Parent: 6306, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6318, Parent: 6317)

grep (PID: 6318, Parent: 6317, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6315, Parent: 1)

rsyslogd (PID: 6315, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6316, Parent: 1)

dbus-daemon (PID: 6316, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6319, Parent: 1)

generate-config (PID: 6319, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6320, Parent: 6319)

pkill (PID: 6320, Parent: 6319, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6324, Parent: 1)

journalctl (PID: 6324, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6325, Parent: 1)

gdm-wait-for-drm (PID: 6325, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6332, Parent: 1)

rsyslogd (PID: 6332, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6333, Parent: 1)

dbus-daemon (PID: 6333, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6337, Parent: 1)

journalctl (PID: 6337, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6338, Parent: 1)

systemd-journald (PID: 6338, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6341, Parent: 1)

systemd-logind (PID: 6341, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6400, Parent: 1)

agetty (PID: 6400, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6401, Parent: 1)

rsyslogd (PID: 6401, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6402, Parent: 1)

dbus-daemon (PID: 6402, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6406, Parent: 1)

gpu-manager (PID: 6406, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6407, Parent: 6406)

sh (PID: 6407, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6408, Parent: 6407)

grep (PID: 6408, Parent: 6407, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6409, Parent: 6406)

sh (PID: 6409, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6410, Parent: 6409)

grep (PID: 6410, Parent: 6409, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6411, Parent: 6406)

sh (PID: 6411, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6411)

grep (PID: 6412, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6413, Parent: 6406)

sh (PID: 6413, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6414, Parent: 6413)

grep (PID: 6414, Parent: 6413, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6417, Parent: 6406)

sh (PID: 6417, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

systemd New Fork (PID: 6415, Parent: 1)

rsyslogd (PID: 6415, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6416, Parent: 1)

dbus-daemon (PID: 6416, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6418, Parent: 1)

generate-config (PID: 6418, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6419, Parent: 6418)

pkill (PID: 6419, Parent: 6418, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6425, Parent: 1)

systemd-logind (PID: 6425, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6482, Parent: 1)

gdm-wait-for-drm (PID: 6482, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6483, Parent: 1)

journalctl (PID: 6483, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6490, Parent: 1)

rsyslogd (PID: 6490, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6496, Parent: 1)

journalctl (PID: 6496, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6497, Parent: 1)

systemd-journald (PID: 6497, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6500, Parent: 1)

systemd-logind (PID: 6500, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6557, Parent: 1)

agetty (PID: 6557, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6558, Parent: 1)

dbus-daemon (PID: 6558, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6559, Parent: 1)

rsyslogd (PID: 6559, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6563, Parent: 1)

gpu-manager (PID: 6563, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6564, Parent: 6563)

sh (PID: 6564, Parent: 6563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6565, Parent: 6564)

grep (PID: 6565, Parent: 6564, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6566, Parent: 6563)

sh (PID: 6566, Parent: 6563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6567, Parent: 6566)

grep (PID: 6567, Parent: 6566, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6568, Parent: 6563)

sh (PID: 6568, Parent: 6563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6569, Parent: 6568)

grep (PID: 6569, Parent: 6568, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6570, Parent: 6563)

sh (PID: 6570, Parent: 6563, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6571, Parent: 6570)

grep (PID: 6571, Parent: 6570, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6572, Parent: 1)

rsyslogd (PID: 6572, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6573, Parent: 1)

generate-config (PID: 6573, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6574, Parent: 6573)

pkill (PID: 6574, Parent: 6573, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6578, Parent: 1)

gdm-wait-for-drm (PID: 6578, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6579, Parent: 1)

journalctl (PID: 6579, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6586, Parent: 1)

rsyslogd (PID: 6586, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6589, Parent: 1)

journalctl (PID: 6589, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6590, Parent: 1)

systemd-journald (PID: 6590, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6593, Parent: 1)

systemd-logind (PID: 6593, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6650, Parent: 1)

agetty (PID: 6650, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6651, Parent: 1)

dbus-daemon (PID: 6651, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6652, Parent: 1)

rsyslogd (PID: 6652, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6656, Parent: 1)

gpu-manager (PID: 6656, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6657, Parent: 6656)

sh (PID: 6657, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6658, Parent: 6657)

grep (PID: 6658, Parent: 6657, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6659, Parent: 6656)

sh (PID: 6659, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6660, Parent: 6659)

grep (PID: 6660, Parent: 6659, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6661, Parent: 6656)

sh (PID: 6661, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6662, Parent: 6661)

grep (PID: 6662, Parent: 6661, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6664, Parent: 6656)

sh (PID: 6664, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 6663, Parent: 1)

rsyslogd (PID: 6663, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6665, Parent: 1)

generate-config (PID: 6665, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6666, Parent: 6665)

pkill (PID: 6666, Parent: 6665, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6672, Parent: 1)

gdm-wait-for-drm (PID: 6672, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6673, Parent: 1)

journalctl (PID: 6673, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6678, Parent: 1)

rsyslogd (PID: 6678, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6681, Parent: 1)

journalctl (PID: 6681, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6682, Parent: 1)

systemd-journald (PID: 6682, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6685, Parent: 1)

systemd-logind (PID: 6685, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6742, Parent: 1)

agetty (PID: 6742, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6743, Parent: 1)

dbus-daemon (PID: 6743, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6744, Parent: 1)

rsyslogd (PID: 6744, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6748, Parent: 1)

gpu-manager (PID: 6748, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6749, Parent: 6748)

sh (PID: 6749, Parent: 6748, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6750, Parent: 6749)

grep (PID: 6750, Parent: 6749, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6751, Parent: 6748)

sh (PID: 6751, Parent: 6748, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6752, Parent: 6751)

grep (PID: 6752, Parent: 6751, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6754, Parent: 6748)

sh (PID: 6754, Parent: 6748, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6755, Parent: 6754)

grep (PID: 6755, Parent: 6754, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6753, Parent: 1)

dbus-daemon (PID: 6753, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6756, Parent: 1)

rsyslogd (PID: 6756, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6757, Parent: 1)

generate-config (PID: 6757, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6758, Parent: 6757)

pkill (PID: 6758, Parent: 6757, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6764, Parent: 1)

gdm-wait-for-drm (PID: 6764, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6765, Parent: 1)

journalctl (PID: 6765, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6769, Parent: 2935)

dbus-daemon (PID: 6769, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6770, Parent: 2935)

pulseaudio (PID: 6770, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6771, Parent: 1)

rtkit-daemon (PID: 6771, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6774, Parent: 1)

polkitd (PID: 6774, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6783, Parent: 1)

rsyslogd (PID: 6783, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6787, Parent: 2935)

pulseaudio (PID: 6787, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6788, Parent: 1)

dbus-daemon (PID: 6788, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6789, Parent: 1)

rtkit-daemon (PID: 6789, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6792, Parent: 1)

systemd-logind (PID: 6792, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6826, Parent: 1)

polkitd (PID: 6826, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6857, Parent: 2935)

dbus-daemon (PID: 6857, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6858, Parent: 1)

journalctl (PID: 6858, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6859, Parent: 1)

systemd-journald (PID: 6859, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6860, Parent: 1)

agetty (PID: 6860, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6861, Parent: 1)

rsyslogd (PID: 6861, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6864, Parent: 1)

systemd-logind (PID: 6864, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6921, Parent: 1)

gpu-manager (PID: 6921, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6925, Parent: 6921)

sh (PID: 6925, Parent: 6921, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6926, Parent: 6925)

grep (PID: 6926, Parent: 6925, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6927, Parent: 6921)

sh (PID: 6927, Parent: 6921, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6928, Parent: 6927)

grep (PID: 6928, Parent: 6927, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6929, Parent: 6921)

sh (PID: 6929, Parent: 6921, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6930, Parent: 6929)

grep (PID: 6930, Parent: 6929, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6931, Parent: 2935)

pulseaudio (PID: 6931, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6934, Parent: 1)

rsyslogd (PID: 6934, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6935, Parent: 1)

generate-config (PID: 6935, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6936, Parent: 6935)

pkill (PID: 6936, Parent: 6935, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6937, Parent: 1)

dbus-daemon (PID: 6937, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6941, Parent: 1)

rtkit-daemon (PID: 6941, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6944, Parent: 1)

polkitd (PID: 6944, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6948, Parent: 1)

gdm-wait-for-drm (PID: 6948, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6952, Parent: 1)

journalctl (PID: 6952, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6954, Parent: 2935)

dbus-daemon (PID: 6954, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.x86-20240507-1844.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Aqua.x86-20240507-1844.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf89c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf93c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Aqua.x86-20240507-1844.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeffc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Aqua.x86-20240507-1844.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
Aqua.x86-20240507-1844.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Aqua.x86-20240507-1844.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb01:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Aqua.x86-20240507-1844.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa1b5:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Aqua.x86-20240507-1844.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x82c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5432.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf84c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf89c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf93c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xeffc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5940:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb01:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa1b5:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5432.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x82c2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x942:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x956:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x96a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x97e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x992:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xabe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xad2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5ba:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 6 entries

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff/fdsocket/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Queries the IP of a very long domain name

Source: unknown	DNS traffic detected: query: net.kovey-net.lol.v:fJV66a/PV!E(kx 5\|2Zv:fVNNPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.v:f66a/PV!E(e):H 5V2Zv:fNNPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.v:f 66a/PV!E(Nx 52Zv:fg NNPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.v:fI JJPV!a/E<O@@2 Y5; qv v:f0.66
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.v:fx66a/PV!E(":# 5w2Zv:fpxJJPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.w:f 66a/PV!E(@9Y 5'Pw:ft JJPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.w:fZ66a/PV!E(x 5_w:fNNPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.w:f* 66a/PV!E(@9Y 5K5Pqw:f1 JJPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.w:fX/66a/PV!E(7: 5"w:f/NNPV!a
Source: unknown	DNS traffic detected: query: net.kovey-net.lol.w:fe66a/PV!E(@9Y 54CPw:f3lJJPV!a

Source: global traffic	TCP traffic: 192.168.2.13:44728 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.13:44594 -> 94.156.8.76:33966

Source: /usr/sbin/rsyslogd (PID: 5606)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5691)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5813)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5891)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5987)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6071)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6141)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6157)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6234)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6301)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6315)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6332)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6401)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6415)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6490)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6559)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6572)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6586)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6652)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6663)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6744)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6756)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6783)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6861)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6934)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 5886)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6080)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6240)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6338)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6497)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6590)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6682)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6859)	Socket: <unknown socket type>:unknown

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.v:fJV66a/PV!E(kx 5\|2Zv:fVNNPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.v:f66a/PV!E(e):H 5V2Zv:fNNPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.v:f 66a/PV!E(Nx 52Zv:fg NNPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.v:fI JJPV!a/E<O@@2 Y5; qv v:f0.66
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.v:fx66a/PV!E(":# 5w2Zv:fpxJJPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.w:f 66a/PV!E(@9Y 5'Pw:ft JJPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.w:fZ66a/PV!E(x 5_w:fNNPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.w:f* 66a/PV!E(@9Y 5K5Pqw:f1 JJPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.w:fX/66a/PV!E(7: 5"w:f/NNPV!a
Source: global traffic	DNS traffic detected: DNS query: net.kovey-net.lol.w:fe66a/PV!E(@9Y 54CPw:f3lJJPV!a

Source: syslog.411.dr

String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5435, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5603, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5606, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5607, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5688, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5690, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5691, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5696, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5697, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5786, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5275, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5787, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5792, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5813, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5816, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5877, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5878, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5881, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5955, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5987, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5988, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5989, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5965, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5996, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6141, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6142, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6140, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6169, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6300, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6402, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6406, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6489, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6558, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6559, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6572, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6586, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6656, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6590, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6672, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6677, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6678, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6748, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6756, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6682, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6857, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6861, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6921, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5435, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5603, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5606, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5607, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5688, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5690, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5691, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5696, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5697, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5786, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5275, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5787, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5792, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5813, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5816, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5877, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5878, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5881, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5891, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5955, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5956, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5987, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5988, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5989, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5965, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 5996, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6141, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6142, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6140, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6169, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6300, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6402, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6406, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6489, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6558, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6559, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6572, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6586, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6656, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6590, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6672, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6677, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6678, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6748, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6756, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6682, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6857, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6861, result: successful	Jump to behavior
Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5434)	SIGKILL sent: pid: 6921, result: successful	Jump to behavior

Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Aqua.x86-20240507-1844.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/215@11/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5603)	File: /proc/5603/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5680)	File: /proc/5680/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5690)	File: /proc/5690/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5786)	File: /proc/5786/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5792)	File: /proc/5792/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5955)	File: /proc/5955/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5988)	File: /proc/5988/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6067)	File: /proc/6067/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6072)	File: /proc/6072/mounts
Source: /usr/bin/dbus-daemon (PID: 6142)	File: /proc/6142/mounts
Source: /usr/bin/dbus-daemon (PID: 6158)	File: /proc/6158/mounts
Source: /usr/bin/dbus-daemon (PID: 6235)	File: /proc/6235/mounts
Source: /usr/bin/dbus-daemon (PID: 6302)	File: /proc/6302/mounts
Source: /usr/bin/dbus-daemon (PID: 6316)	File: /proc/6316/mounts
Source: /usr/bin/dbus-daemon (PID: 6333)	File: /proc/6333/mounts
Source: /usr/bin/dbus-daemon (PID: 6402)	File: /proc/6402/mounts
Source: /usr/bin/dbus-daemon (PID: 6416)	File: /proc/6416/mounts
Source: /usr/bin/dbus-daemon (PID: 6558)	File: /proc/6558/mounts
Source: /usr/bin/dbus-daemon (PID: 6651)	File: /proc/6651/mounts
Source: /usr/bin/dbus-daemon (PID: 6743)	File: /proc/6743/mounts
Source: /usr/bin/dbus-daemon (PID: 6753)	File: /proc/6753/mounts
Source: /usr/bin/dbus-daemon (PID: 6769)	File: /proc/6769/mounts
Source: /usr/bin/dbus-daemon (PID: 6788)	File: /proc/6788/mounts
Source: /usr/bin/dbus-daemon (PID: 6857)	File: /proc/6857/mounts
Source: /usr/bin/dbus-daemon (PID: 6937)	File: /proc/6937/mounts
Source: /usr/bin/dbus-daemon (PID: 6954)	File: /proc/6954/mounts

Source: /usr/libexec/gsd-rfkill (PID: 5435)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5435)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5440)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5614)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5614)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5614)	File: /run/systemd/seats/.#seat0XKE8UI	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5679)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5707)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5707)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5707)	File: /run/systemd/seats/.#seat0VjHljK	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5770)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5816)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5816)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5816)	File: /run/systemd/seats/.#seat0n2Ny4W	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5881)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	File: /run/systemd/journal/streams/.#9:66606U7U5uf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	File: /run/systemd/journal/streams/.#9:66607OD6MKg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	File: /run/systemd/journal/streams/.#9:66667llEJNg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	File: /run/systemd/journal/streams/.#9:66767B9Xurh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	File: /run/systemd/journal/streams/.#9:66865Fm5LMg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5894)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5894)	File: /run/systemd/seats/.#seat055BR6T	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68751ZUzcvg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68753Pi6kqf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:687549ul4xd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68763WIhRaf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68764xOD24c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68765qY6e7g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68772C744We	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68773wIpkEf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68774pnxXRd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68775fOMIwe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68783V3Kb9g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68785lxcL0c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:68862ai8Lpd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:67920G084xf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	File: /run/systemd/journal/streams/.#9:67943QknpZd	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5974)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5996)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5996)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5996)	File: /run/systemd/seats/.#seat01jkZDB	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6055)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69686kF5PkY
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69689RafazW
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69690Log1wX
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69696zMyZ3U
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:6970098zyRW
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69724lXmVXV
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:698007oIGAX
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:69801M8EWfX
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:68498VAupeY
Source: /lib/systemd/systemd-journald (PID: 6080)	File: /run/systemd/journal/streams/.#9:685723zYLRX
Source: /lib/systemd/systemd-logind (PID: 6083)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6083)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6083)	File: /run/systemd/seats/.#seat0JUlak8
Source: /lib/systemd/systemd-logind (PID: 6169)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6169)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6169)	File: /run/systemd/seats/.#seat0KZGDrH
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:70622qRCjT2
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:70623MVHYn1
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:70631dCaba3
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:70632mdnZW1
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:70642GUCiP3
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:71753Hkspr4
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:71755rMokr3
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:71095KAfSL0
Source: /lib/systemd/systemd-journald (PID: 6240)	File: /run/systemd/journal/streams/.#9:711692mZxP4
Source: /lib/systemd/systemd-logind (PID: 6243)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6243)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6243)	File: /run/systemd/seats/.#seat0za8Vdi
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72713xtRCHp
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:727145rFduq
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72715dm3ybu
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72717VGPGOq
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72718ZH0etr
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:727249tn82r
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72736gcNz6t
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:72738igAyHt
Source: /lib/systemd/systemd-journald (PID: 6338)	File: /run/systemd/journal/streams/.#9:73729jStt4q
Source: /lib/systemd/systemd-logind (PID: 6341)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6341)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6341)	File: /run/systemd/seats/.#seat0WSWc4G
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/seats/.#seat0ajdTv2
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73432cNoFTs
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73433wvMIHu
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73434JvT8Lu
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73440ZqDrDu
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73441aezA6q
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:73443SGlk0u
Source: /lib/systemd/systemd-journald (PID: 6497)	File: /run/systemd/journal/streams/.#9:74234foXG7q
Source: /lib/systemd/systemd-logind (PID: 6500)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6500)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6500)	File: /run/systemd/seats/.#seat02YgyaF
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:7523563H8ev
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:75236o04Gyw
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:75237CRzT9u
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:75243oVTjpw
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:75244Z3twmu
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:75245MwL8cu
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:7465123mePt
Source: /lib/systemd/systemd-logind (PID: 6593)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6593)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6593)	File: /run/systemd/seats/.#seat0pHmEdI
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76364op3iJu
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76365rpukHu
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76371MJTaJr
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:763722urB0r
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76379GqF8xt
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76386uiga3q
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76387TMHdtr
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76462XlHisr
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:769369fDF5t
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:76946ZXSvgt
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:77065ac00eu
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:771655OHjYq
Source: /lib/systemd/systemd-journald (PID: 6682)	File: /run/systemd/journal/streams/.#9:77367BSD2Fr
Source: /lib/systemd/systemd-logind (PID: 6685)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6685)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6685)	File: /run/systemd/seats/.#seat0tz7BvF
Source: /usr/lib/policykit-1/polkitd (PID: 6774)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/seats/.#seat0QmCT7M
Source: /usr/lib/policykit-1/polkitd (PID: 6826)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:784044ZqH0O
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78406xko8FO
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78407LVqA2P
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:784084bWJTR
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:784096ExfTP
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78410jb8omR
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78412NmFKTQ
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:784133x6HjO
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78415yUNB5R
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78419dg9qIQ
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78420Dr08BQ
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78427sGN9qO
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78428q55meQ
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78429FgDU1Q
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:784301NXa5O
Source: /lib/systemd/systemd-journald (PID: 6859)	File: /run/systemd/journal/streams/.#9:78431itEBTQ
Source: /lib/systemd/systemd-logind (PID: 6864)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6864)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6864)	File: /run/systemd/seats/.#seat0S3kLGd
Source: /usr/lib/policykit-1/polkitd (PID: 6944)	Directory: /root/.cache

Source: /lib/systemd/systemd-journald (PID: 6682)

Empty hidden file: /run/systemd/journal/streams/.#9:77367BSD2Fr

Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5380/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5380/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/238/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/238/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/239/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/239/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5275/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5275/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/241/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/241/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5707/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5707/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	File opened: /proc/247/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5698)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5700)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5702)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5764)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5766)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5774)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5778)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5780)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5958)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5960)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5963)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5966)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5969)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5973)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5979)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5983)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6147)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6149)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6151)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6153)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6155)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6159)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6307)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6311)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6313)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6317)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6407)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6409)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6413)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6564)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6566)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6568)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6570)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6657)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6659)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6661)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6664)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6749)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6751)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6754)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6925)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6927)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6929)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"

Source: /bin/sh (PID: 5699)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5701)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5703)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5765)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5769)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5777)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5779)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5781)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5959)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5962)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5964)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5967)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5970)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5975)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5980)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5984)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6148)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6150)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6152)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6154)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6156)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6308)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6312)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6314)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6318)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6408)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6410)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6414)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6565)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6567)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6569)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6658)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6660)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6662)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6750)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6752)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6755)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6926)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6928)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6930)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

Source: /usr/share/gdm/generate-config (PID: 5783)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5986)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6163)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6320)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6419)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6574)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6666)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6758)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6936)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd-journald (PID: 5886)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6080)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6240)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6338)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6497)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6590)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6682)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6859)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 5688)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5696)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6140)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6300)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6400)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6557)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6650)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6742)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6860)	Reads version info: /etc/issue

Source: /usr/sbin/rsyslogd (PID: 5606)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5606)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5691)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5691)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5692)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5813)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5813)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5891)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5891)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5957)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5987)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5987)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6071)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6141)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6157)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6234)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6301)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6315)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6315)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6332)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6401)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6415)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6415)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6490)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6559)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6572)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6572)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6652)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6663)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6663)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6744)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6756)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6756)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6783)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6861)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6934)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6934)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.x86-20240507-1844.elf (PID: 5433)

File: /tmp/Aqua.x86-20240507-1844.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5692)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5957)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6146)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6306)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6406)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6563)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6656)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6748)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6921)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pulseaudio (PID: 5607)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5783)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5956)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5986)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5989)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6163)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6320)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6419)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6574)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6666)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6758)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6770)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6787)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6931)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6936)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 5440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5606)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5607)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5688)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5691)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5696)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5697)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5813)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5886)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5891)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5951)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5956)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5957)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5965)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5987)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5989)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6071)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6080)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6140)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6141)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6157)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6234)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6240)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6300)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6301)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6315)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6332)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6338)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6400)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6401)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6415)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6490)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6497)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6557)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6559)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6572)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6586)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6590)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6650)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6652)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6663)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6682)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6742)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6744)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6756)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6770)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6783)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6787)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6859)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6860)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6861)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6931)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6934)	Queries kernel information via 'uname':

Source: syslog.45.dr	Binary or memory string: May 7 20:45:53 galassia kernel: [ 106.018898] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: syslog.45.dr	Binary or memory string: May 7 20:45:53 galassia kernel: [ 106.018921] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Aqua.x86-20240507-1844.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Aqua.x86-20240507-1844.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.x86-20240507-1844.elf PID: 5432, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Hide Artifacts	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Aqua.x86-20240507-1844.elf	50%	ReversingLabs	Linux.Trojan.Mirai
Aqua.x86-20240507-1844.elf	100%	Avira	EXP/ELF.Mirai.Z.A
Aqua.x86-20240507-1844.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
net.kovey-net.lol	94.156.8.76	true	true	unknown
net.kovey-net.lol.w:f 66a/PV!E(@9Y 5'Pw:ft JJPV!a	unknown	unknown	true	low
net.kovey-net.lol.w:fX/66a/PV!E(7: 5"w:f/NNPV!a	unknown	unknown	true	low
net.kovey-net.lol.w:fe66a/PV!E(@9Y 54CPw:f3lJJPV!a	unknown	unknown	true	low
net.kovey-net.lol.v:fx66a/PV!E(":# 5w2Zv:fpxJJPV!a	unknown	unknown	true	low
net.kovey-net.lol.v:f 66a/PV!E(Nx 52Zv:fg NNPV!a	unknown	unknown	true	low
net.kovey-net.lol.w:f* 66a/PV!E(@9Y 5K5Pqw:f1 JJPV!a	unknown	unknown	true	low
net.kovey-net.lol.v:f66a/PV!E(e):H 5V2Zv:fNNPV!a	unknown	unknown	true	low
net.kovey-net.lol.w:fZ66a/PV!E(x 5_w:fNNPV!a	unknown	unknown	true	low
net.kovey-net.lol.v:fJV66a/PV!E(kx 5\|2Zv:fVNNPV!a	unknown	unknown	true	low
net.kovey-net.lol.v:fI JJPV!a/E<O@@2 Y5; qv v:f0.66	unknown	unknown	true	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.411.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.8.76	net.kovey-net.lol	Bulgaria		43561	NET1-ASBG	true
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.156.8.76	Aqua.x86-20240507-1758.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7-20240507-1758.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	QvahMBUmnY.elf	Get hash	malicious	Mirai	Browse
	pWftP6smaX.elf	Get hash	malicious	Mirai	Browse
	7AviWAaJMa.elf	Get hash	malicious	Mirai	Browse
	B8J4uob2ZB.elf	Get hash	malicious	Mirai	Browse
	FCHWrX6B3i.elf	Get hash	malicious	Mirai	Browse
	7iEsW8J1ja.elf	Get hash	malicious	Mirai	Browse
	9CkHkdlOc5.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	Aqua.x86-20240507-1758.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	QvahMBUmnY.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86-20240502-1008.elf	Get hash	malicious	Unknown	Browse
	pWftP6smaX.elf	Get hash	malicious	Mirai	Browse
	FCHWrX6B3i.elf	Get hash	malicious	Mirai	Browse
	7iEsW8J1ja.elf	Get hash	malicious	Mirai	Browse
	9CkHkdlOc5.elf	Get hash	malicious	Mirai	Browse
	eHnz21FDVw.elf	Get hash	malicious	Mirai	Browse
	WgSSuSCdZb.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.x86-20240507-1758.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	QvahMBUmnY.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86-20240502-1008.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	pWftP6smaX.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	FCHWrX6B3i.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	7iEsW8J1ja.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	9CkHkdlOc5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	eHnz21FDVw.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	WgSSuSCdZb.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
NET1-ASBG	Aqua.x86-20240507-1758.elf	Get hash	malicious	Mirai	Browse	94.156.8.76
	Aqua.arm7-20240507-1758.elf	Get hash	malicious	Mirai	Browse	94.156.8.76
	file.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	s8VwReJbTx.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	vuxwIDk4Ju.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	3ZB2vGvuhW.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	ZK3lwWDDwJ.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	9Jjv9FqBaF.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	kEIcdmgkEA.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244
	S2Ow8edPCF.exe	Get hash	malicious	Socks5Systemz	Browse	87.121.105.244

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/run/systemd/journal/streams/.#9:66606U7U5uf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.526465736789329
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu0RE0TPCFlsjs7Lbr:SbFuFyLVIg1BG+f+Mu0Rfjxji4s
MD5:	F0E694DF9CA0068C8B39DC3600305F8A
SHA1:	53DBC507F71D065F94BAA1FA4967E88D71DAD7AA
SHA-256:	008DA0949B5191B68A464E74C9D603289CF821C84AA14A89BE482A1120276D25
SHA-512:	53B47128086758DE3355DFF706DD21A995691728F153322F54A2464A251CD6A01B4C96774AAEB6B83CB5CCCE6B391A821E3FF11548AB533ED6EFD9AB00161035
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df966421476647cfbce061e49f35f43c.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:66607OD6MKg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.51214212170864
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5LJdSRWInIFHjs7LH:SbFuFyLVIg1BG+f+MxJwwIIBji4s
MD5:	ECE8C8BA95A9C9A6809241C0A8A2BB71
SHA1:	1C874CB85168FEEC109B51E54B3EDD400BB3B6DA
SHA-256:	B23C91CD4028E78C8F40D0942108ACA2F8E6C786C65F7A080C103D1D10AEF9C7
SHA-512:	60BBEA358AB228E59EB4646503D602A63181B507D30F9EC691D1263EBB00199514653CAE0532DC1B4DBD7D3A5B6B82494A890362AB3F89313ADE10831397EBAD
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=30aa9fb584ba4358b14941477be93107.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:66667llEJNg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.482433376896886
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4Hkxb1WPa9VPs22jZcHcljX+:qgFq6g10+f+M4Ex1WPcuzmAu
MD5:	136B5F63C7C68A16C60314168A3BF06D
SHA1:	183E9BECDAA4F37D61BA82F572BD8312CE844AFD
SHA-256:	079E954D17BE01D2988A40C2B77E3DBBE2B847EFA043415C41CB23CBD0018CD8
SHA-512:	9B66F7CAE6531591DA476B5277BA458F2ACD0B99BED730B8C0CEE7A656E2D51F2474B1323D12F3470357838AE67A8401BE58E69CB517220E1EC15BE22153F702
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2b72db4eb17e46ffa2739097ad63b80b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:66767B9Xurh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.459579633392255
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5agcUrppc+I8js1Ha:SbFuFyLVIg1BG+f+MLbLI8josQu
MD5:	1A8F71F9D55E254BF1213D1CF6AE8EBE
SHA1:	24F27F38CCDE00AF893F08C70FF7C6B991B86D80
SHA-256:	7E2CA446725E042F29EED655B1820F1A67F0E13999F1AEA86E17F97C23117123
SHA-512:	5798A8526AB26967897B0C81D4D14903F3E7694667AAFF390B3DA952E6C1CDF2AA3C1EF11BAE9F4D5CF11238B163EAE1E40363F4169AFAAA64DE7782C2E0372A
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38dcbf9916004344a82f671f29ae5b5f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:66865Fm5LMg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.307480719350573
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrwIcLLqiyXGFlsjsO:SbFuFyLVIg1BG+f+MsbyXG8jtWL0
MD5:	CB701DE02D2C5C9421A9EC3DDD38F083
SHA1:	FE1E96D49406C9A2EFABEA2A716DF19684C214C3
SHA-256:	2C5A9878DD4EF83BD190A534A16560664C18831E07F5C3A5F918AE136BFA4CED
SHA-512:	A34763EA4583AA44340E455C9C79C60E61BAAB8F1D6755174953762D217815BA269EB2C20577373A94D9A5E68D57957680163642A7522136142D7FEEA4C00A34
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4316603886b46dbb74d8074c0e78cea.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:67920G084xf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.409229152876583
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyWjDfBLRCZ022js16:SbFuFyLVIg1BG+f+MyW/ZgZ022josQu
MD5:	F5DFBFAD3DDE771AF3BD438F43D6BEE4
SHA1:	E1A43312E159790E5534033E7460C7F00AF7E3F0
SHA-256:	C689A0495E57B585711E39D1814858A3B7051EEAC60957A190D2859E0177C583
SHA-512:	BBD124D26465C2090EB77527C6452CC57BD940ECDD1E96A68C22597C4FCE5698201FB9A1FE530B3FFA712F0D71C27945ECEF3EAFE2F045A4E1C6C90B37826DE3
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=881510f3c9d04782bb484b48e5a30504.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:67943QknpZd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.387471710852255
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+zcOUIPAgrxsjshQJ:SbFuFyLVIg1BG+f+M+ETjtWL0
MD5:	463FD9FA31E57E4776C95C744E3049C2
SHA1:	C1777853F99C72E4BCFD18534F5AF747E191FAC7
SHA-256:	5BFFA65EBBF232F47C148B1F2C9AAA9A4F98391E87283571F8905DEB15C366FD
SHA-512:	DA468135CF125A07D16323BFBF7AC7AEFAA87040BF1BC50BCF5BF38725ED97DEF500A0EE43973C131184D09A5BA411C7A906D9A7276ABD7188FCC920BD275FF7
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4f15def5b7244b429a4fff11c984683b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:68498VAupeY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553767
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5RCdESbG1HXeEcWu/:SbFuFyLVIg1BG+f+MqESg3buqjLkGq
MD5:	50C7E59E59CD11BB5709F19243D999B8
SHA1:	D669464D2F8611F23B16B5ABC752E3869E97F170
SHA-256:	EE3CA2BF74F58C7A49A119401DE64C095A3B4ACDA4DFBFC81E709E1947E8D8F7
SHA-512:	6214F7CDAF1232C07068E354C26D83983B4185E7F11BB993FF7B22CC6843E492B91B95315C7AB9DD9B0BDDDBB85307D5F653C095C736E00559AD5D22BA28B338
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dee4528a1f844039cdfb2b0c9c2a933.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:685723zYLRX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.436204075221868
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7fE1EckQEcWLBN92d:SbFuFyLVIg1BG+f+MCBWL52josQu
MD5:	9D13E34B0F9AF68C0A9CD4C4A48995BD
SHA1:	CBDC410495E1FD5B43490600FC4862FBE027B58D
SHA-256:	91D0F7A516CF01F80682BEFC99B04E3CA261AF531171E1B60F802434888A7049
SHA-512:	900B26C14D0CAC7243DC1E5D6693AB4219422E3E341FCBDA41CAB6CE62D8780C12AE279FE001CAA0E705A818D6CC6644ECDD29E3008EE9EE015C7C13D316EA37
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=166a46a9ed55493c8a2fdd824172d484.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68751ZUzcvg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.50949597612217
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm693EIHk2rqjs7LbgS:SbFuFyLVIg1BG+f+M693EIHk2rqji4s
MD5:	D65882F7519614EEB47CB6826BE6AA24
SHA1:	8EC720D94FD719BDC5D7944C056371B3AC037C84
SHA-256:	B18155127F3FE6DA36EC2DF9FDD110FFEC90D928DEF67FBE81EF186AD3DBD9F2
SHA-512:	F17DBF01D118F8EC8D7490D0EE5D28BE2F4AB2C8F43D31DAE081E841E3D97177072094D4C1A0D9E8202F227343C27836F642024E4882C22FC2D18FCAEE784CBD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f8360ca7b3a47678a50ddbc50f82cf7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68753Pi6kqf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.416420965005798
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9dHSn0AWqjsjOdlJO:SbFuFyLVIg1BG+f+MHHsfjNE
MD5:	A2E401E1B8B5DFDE69783A59571A2F18
SHA1:	41CA0A938F09E1FA3B9D9CD3BB66EA76E23DF4CD
SHA-256:	12EC6DD24BFA1395F19EFE7C7D6525906242CF750A92CC6A0C84E9D785CC6FEB
SHA-512:	B6737F9F9175F4E29DD051ECD178243361831FAD5D3CEBC754A3A2FD59F5A86133CBDC63627F89BF569772EEFFDA54F4199B514C6B6F62C63042791996FF7B66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=799adc93b88e4e35a8208bc1d35094b8.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:687549ul4xd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.386849091957676
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4W4KEA+O54s22jshP:SbFuFyLVIg1BG+f+M4W4vQ4sZjbVC
MD5:	CAECDFBBC435B18305E83DC59961A63E
SHA1:	224BCA9A151158716B9DDBF01C22155C6EE985E9
SHA-256:	37D356C1CCF272F6360B802BF588F9D2D98903FC6FCA5519032D057F3FB589A4
SHA-512:	6380E5AA8105B1833F0FE08E2A9CCE99A2EE9BE5DE3A26D54CB743AB3DF6D0F39900CEEB4F740AC5856FC25EA9C168AFB5158118F66F0CD341724D67854B5A4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=28113e32520b4566aeae5731a677af56.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:68763WIhRaf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4421759768326945
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MwGQeMHdahuqjNALyAZD:qgFq6g1af+MwGQiFIZD
MD5:	7450D989F18F06500EEE0C238B8B0450
SHA1:	F94F25ECCCA1514C18B348171FAB7A08D6AF27F4
SHA-256:	4A5A01D8AC857B30616AEAC0EDA3973328EBCB016D03268F82B7EC7C45311210
SHA-512:	6979B787BD627B918282F991BFBEBEA37ED6D8F449950B8FC499F6D7324B9F01D08C52C61A2084A231C6FF05BB856A297A2BEE5536656A3306E2205BDA253743
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3230e70cd45940f6b29bdf3a27cbfa25.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68764xOD24c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.394439809936389
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6GX8NcMlTTj7BT+wU:SbFuFyLVIg1BG+f+M6GGDJTBaZjosQu
MD5:	D2E495226142FF303019986E3109313C
SHA1:	21D5C3338B51F3F369BD2E5183FDED5F9DFE2A6F
SHA-256:	87331B11AA188314B3A3F09B5684B612378F55E079EF74E8C9BCCF932171335F
SHA-512:	F9A6EC921C0976225B592CE405715646AFF7512BDF77399200930DD647A116BE6FA79FE76EBEC6005488E3154E82B01ABD6B56ABCF9799A87B5DB797380BB091
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c42cd63ad2049f591669baad61516a1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68765qY6e7g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.373249485183554
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GYVFV8mVWVt+sjsO:SbFuFyLVIg1BG+f+M493uVdjtWL0
MD5:	5DDD51D856B0BC51C3EF7858008E5152
SHA1:	57E4C8EFA784C2F53075B0E7320BDCB97BE5E708
SHA-256:	436D01F79D2C4E456663DB37676318649E847A765D4BB7AD7C99F423BB99E859
SHA-512:	E88FFB44FBC84B33C479F305E088232A33FC679245938FA513382F6573D9FE30D491476A3F4D571360BE9BAF69ECF3219BF431D927F16942E01203356D94DB67
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c61378b9bb5466ab8ae8cf4202c0c60.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:68772C744We

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.395447573435239
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5bwSqGnRBc8Yd78j+:SbFuFyLVIg1BG+f+MFwSqGnc88wjLkGq
MD5:	E1CAEBAE9C0B65285E9C8E496C5F8681
SHA1:	9C8EC99353CD341C5BF6AFFE8DA8F2CE51BA6200
SHA-256:	8220B1282DA8BAD53C120059B17A25501B252677831F4E60A01151BFBC702EF1
SHA-512:	2DD71960C8F9BBB43F0C96C4F3E04B60A3528B1982990B8333F76813E5DDEB3ACCB617848C9967740513B6413198BAD684B087E8EE05DB402D176773243D0493
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38db0c47afc4424d9180b4182e9d4fd8.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:68773wIpkEf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.453652488427742
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp05ssQQPaqjsjOdlE:SbFuFyLVIg1BG+f+MmxFSqjNE
MD5:	FE6930E6FF57811BCD245095C80BEBFD
SHA1:	E593B912354A0822DB26F862C6A696DE25312FFA
SHA-256:	EC0575C65E0B9631792E0BF01C01E17924AE50431636A6CEA9ED611CEE7A7FEA
SHA-512:	1BD6806D167D369CB16678F04DEA6BA470AA43AE919EF8D5AC2F612B9706696F54C074A09122068170481261ED1419A595CE3A6C96AFA95533B14CB395778553
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7c45780fac34033bf61779323550647.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:68774pnxXRd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.490426218168766
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrlPx3vXsjsicWmI2d:SbFuFyLVIg1BG+f+MBPx30jZcHcljX+
MD5:	428335550FDC7E05E29DF00196AC35D8
SHA1:	801F3663A29949BD66ECCBC9992EFA918890D168
SHA-256:	F5CDD0761931E0259FE710F4BE26BEDCBF2518F9EBA8F297AC66C551EB259FC6
SHA-512:	A95C7B156F930F3970637CF0626DE554E5C96EF5523E1F28059BE6C46E788CA0F9A66B2C83368B38A7FA1FA1135CD6FB7232253632F66307745222D6695BE601
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac53697d9a264e60bd35dc55f748cca1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:68775fOMIwe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.409365784712534
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8iBIipUVcAsjshKJg:SbFuFyLVIg1BG+f+M8iBPpUVcJjbVC
MD5:	7424F7A7EC7A1CA0275F63E49413E3D9
SHA1:	A1F869E1ED17EF06B4D0BE281EE70CB5A96BF61C
SHA-256:	4EE112901E76A4CBB380D138A401D929074D75D28656A4C9502538ED63680F54
SHA-512:	801CCBDC46F6F47EB608553F590A1BD308D9A56942A72ABC7F6A6694528015F97318724BD6CDA6246F04587A1FA9E37B0AC59B98DB7D4501232FFBE4A2657E94
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66cb20245cb14ea7a5b61c208dd309d3.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:68783V3Kb9g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.479946536873662
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M47QsiAgrqjNdQIeXD:qgFq6g1af+M47QNrw2D
MD5:	5134A0A1832666C3D36D8107AEC7F669
SHA1:	46D6E5BB0DCA887C93C970D159F94541819081AA
SHA-256:	B4A61867AE984344F3050562F4E90BD68714F3E20F564B4297AC072E31F57787
SHA-512:	1EE77695AF30148808DF3D08E11CFB0E94598376E46598451738F8EA57EF35D1E6BF6D629A1B46B2F578675E63B9FB36D91359AEF6C18CF0B748860BCD003C46
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22a49dd25f754a86bba4830162ce8ad7.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68785lxcL0c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5508697703112935
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoFHVn96RmQTrxsjsv:SbFuFyLVIg1BG+f+MoFWRjqji4s
MD5:	FC3B7BDF338A270D7FF511782BAF74D9
SHA1:	BC354F49801379CE72C70AA8383BB9B69A469AE3
SHA-256:	4A627EA9C4FE8D3DB668F883A9B1D41275452A6269BB000D824865CB797BC4A6
SHA-512:	9B2F46170D062D23E107B44D6DE1FB79912CFE7EE44DB9202D28986F57A8BA0683AF2BA914BF639237FF5B709FB0D59D4A1BC6527426AA42CA641F0585AF60CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b50d89b082f5481181ff74706c1ad233.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68862ai8Lpd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.392015387303953
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvPcF1WH+3rqjs1Han:SbFuFyLVIg1BG+f+MXcF1A+bqjoa
MD5:	1A398DAC98173F22C30EC5674AB131CA
SHA1:	35D0B8380105795FC344B40CC452351440BDF794
SHA-256:	D6F08BA1B226E9834C7C72067E0965603FFA24D17619FB52897278116DB32ED6
SHA-512:	5FD4FC0A31F7CBDA28402E0A52E4183B3DFCC8F765702CC847BEB3FABEC62307FB821804FF5D59EA5810545892361AF4D6950BCD80240FC34AA6E91B08A8720D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e3c349f496ea4413b0cdbc262617bfe5.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:69686kF5PkY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.530182873216732
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvjGP1DTAZd8sjs7LH:SbFuFyLVIg1BG+f+MrS1D+ji4s
MD5:	603AEC893470ADFA56BB4218FC1DF0E7
SHA1:	9A0FE3C52E685BCD125FA1D87BC21AA70A7F4D25
SHA-256:	ACFE4EA56EE62ED1BCAA4D5F4A3BE05628355AFC81AA3E552539D70EAE63B1EE
SHA-512:	ECAA6AFCBC255868F76AC23BCA4C332FAB94738AFE24976407E98D30B6802A36FA890BFA7247E88E82BD5610508B228574DD6B23A9E1EAC183B5AD58BDA8A4C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e880d3ca05b3498297c266e231c78a93.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:69689RafazW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.447095024574989
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mw/REKn8jZcHcljX+:qgFq6g10+f+MvKnqmAu
MD5:	6BD2BA25638A507B67ADFF2809D64A64
SHA1:	DF1663498CE144169890476C6A5360480AD0F2B7
SHA-256:	D1B22DC5CB3A6EDBF244ACE492FB78B1BD983B3209559E839DBF970FEEC7C341
SHA-512:	AEB156F4B2BD574016EDEBF0AB2E54395BCB1EE47CF3BD388BD5AC1D76950F0E0473DB811B6792DD1380A3757165CCE50707C41530816AD3F00EFDC536AAF655
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce30651e3fcd422baa0d3691d30d2495.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:69690Log1wX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.474976208308646
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9c/hxgcXg3pUZ0Mqd:SbFuFyLVIg1BG+f+MW/hIpM0ZjosQu
MD5:	13EC58B1EBF199344A888009712490F0
SHA1:	7824223951470759810B32572D2ECDB070384658
SHA-256:	C5F4A05880B0D8616536A52854E45BA9E6D7F70248EB2C7D918C5C12C1BFE33E
SHA-512:	A318483A6E5B7DAC977A4AD24071E6A76197A34E7AF17FA960D5E9248C6BCFF26C85FDCF517ABE9EA185B53EE161EE7DF86FBEF2EB943BA1AC44B29F01131966
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=765183bd4f564576925b029c32ef191f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69696zMyZ3U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.430985957433065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvEJBw9kBe+4bkMxsd:SbFuFyLVIg1BG+f+McG+4bkZjosQu
MD5:	350E61737053BD370DF7BD4B0B62E898
SHA1:	F0743A9EA32EE8CDA85B87F87F73624707214B36
SHA-256:	ED298F38D92AB983271BFF8B2ACF49CB65E6274184923DFF5A31B7072A28E557
SHA-512:	CF5C5B93AE091D77D2D4A30AE404DD10D88141DD8CC6E6179DB36729CB3E6BCAD047ECD6EB3A09AEB3C864A7D1E527DD12A0C3134574F24F2BA496C26301BEB3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e1859d24c75d45fd8067011583aefb80.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:6970098zyRW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.447167050738769
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M62U6cysMqjNALyAZD:qgFq6g1af+MnsMwIZD
MD5:	2B42ED23310253E726B09BF9D18725C9
SHA1:	84D98F33473A9BC4268A9CBC6734B3DD2DE0BA24
SHA-256:	E9F78C0C7CBC9B8DECDDA9251A16A21BFF515676531006AC1BA2BA8D362FED2A
SHA-512:	A52416ACBF0B7AD6A55C8387752BA4DF49305DF1EECD22F17306D83C06144CE95F6B53F722760D376903C168BD7F1A45533F6C69D23FA0F06F8C9DEB23C89FBF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0dd4f97645b940eeb32492a885f430e5.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69724lXmVXV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.479763620064503
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MY+mzlhijZcHcljX+:qgFq6g10+f+MY5j8mAu
MD5:	457988AB6EF68F9EC83432CD584F4960
SHA1:	A6061B435DF555CE64FB5386BCA70C1ED01DC7C6
SHA-256:	6822FECD1E5D866A1DCEBFBF995A042A72ED3593205AC80ABFC4A4E6016C08F7
SHA-512:	2D6961A33D08EA9F9D7D84C2F0A7B28952181B309507CEBDCF5C6D328136627DB7EB74C22A5E1228D2FDFE4628338EBBE05BA0485A77BA5EE3F6F3A496AF22F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59d1829bd4064a4b97cd6b131603dcd5.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:698007oIGAX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.527433195853113
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9FZhVJ66Sv8js7Lbr:SbFuFyLVIg1BG+f+MRhVU0ji4s
MD5:	83615FD4854C4A45743543BD7EF68DCB
SHA1:	ECF4BB0417C92991F02A3B84EC2AFAC7130ED747
SHA-256:	553C471EF4F11B4FAB350AFA422E719B270C353DC1D3A8F2AB8823D35887D4BD
SHA-512:	52794D18E0FC1CC420F7040BDA7B82DAAD6E942EDCE52CEA45DE0C412A1339F9B589ABC294F201469B153A1F7274204847B1C361D1F186633431B8C79B91479B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a71540819d444909152c7d4ea66d838.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:69801M8EWfX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.465821181464439
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrfVyMdB9QGcEWWXNlsA:SbFuFyLVIg1BAf+MXdIGcO0jNdQIeXD
MD5:	BEE45D1B3DB428F966CED665CBF11647
SHA1:	7D1FEAB8BDC0FFBE5D5848207C0ED26D028B2B97
SHA-256:	E3D3AD0C3D3D48C483036469CDEE5FFA5BF0AD73B168766FE64DF2F9F8C1431C
SHA-512:	4017D2A3CDA73BB51E40B11BA52A22BE7373C187675C0D758BF36417FF18E58E83003C68E0C6CB76B7419DD1B56E2DDBD9A591DBE89E908AE6304ACCAF23DEDB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a1540b710842443cadbf357d093f5f32.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70622qRCjT2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.566505139898838
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4l0hdsZIZjs7Lbgw3:SbFuFyLVIg1BG+f+M4TIZji4s
MD5:	902EF5FE11DD43D0ACAC7423E36BAFAB
SHA1:	FCA5307A469B4AECA115B05663CDAB7E5683C295
SHA-256:	818B5D4C91DB31209BF032ED2C117AF609DE68A41CE1298045AE950ECB308C6D
SHA-512:	E879359C557AC786D392FAE0B6285F70E4F8A1F727E49BFB84BC2B9826149691E0FD8E963F54D4E439C0C1A550E2F8E18D8589B0EC113C157E9D60EC776BD9CA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=24f9b64bbcd7442586e1488819396e65.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:70623MVHYn1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.483446188381085
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MXOJF0D3XdYg2jZcHcljX+:qgFq6g10+f+MXUFIdNYmAu
MD5:	0CD51754878A6440542EE6A7F2A1B295
SHA1:	D20349D58482189C914758D3379F678DDF0AF7A3
SHA-256:	19694775BE6B6201EDDAF98E432053C1B32FBDA6A0B413602322559DD747B2C7
SHA-512:	A8ECE19C3E9AD783B8948775063B2AE331DC4C5F7AFAECBACD02B5BF8167B72F860EF6CE0BE5691DE042926C0D1CE07A72134DF96F331B4EB6F418EE6DC03390
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7fd3823b50ea4598b60db368da6b9028.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:70631dCaba3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.379511623562401
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7Vr1Lrc/k2shuxsjx:SbFuFyLVIg1BG+f+MJ1/G6TjosQu
MD5:	BF60481D387F6B67B7ACB90F3EC7E30D
SHA1:	F4C8BFCE1C1B77C1F89782C842D7DFF9DB061DC8
SHA-256:	C53EC7A0F0FABCB3A91FC047DE0A573E0F645D64911F43B3E369D00306529BD6
SHA-512:	0184516A28D7CCF42E8A5E8A2C4EF7F197DD7F9B7DD6A0B3C1F71ECD50E506E7E30004A9BD4957EF4A1E7A61C5ACBC0D5C05034FEEF7080BDE3B897ECFAB1C10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a384e9e563e40b9a215330a1004fd3b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:70632mdnZW1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.387412454593318
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuycDAAlE/Tv8js1Ha:SbFuFyLVIg1BG+f+MuBDAA+IjosQu
MD5:	F348AC0736DAA433719F8BC5553D8680
SHA1:	7DDB1FA726DA2BB2CA79BE25E0239EAA3F19D97F
SHA-256:	42B60532D6FB904B40797F57BB590879BDD933AC8D35A36AEE248F729B5DBD61
SHA-512:	F2A7D81ACD926B3520F3E124406605ED5EE6BA3FACDA266BE943225B98539A8130514816BB46F0DD9B3FFE45FFA504C1136C8D26CF6E9D865E1450E4D4CA103A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d9fddef59fee4f87a126f7fcea8e9acd.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:70642GUCiP3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4076885076175625
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm93VtGEYROQr/Xsjs2Ax:SbFuFyLVIg1BAf+M39kD/8jNALyAZD
MD5:	C59A5DADF2D43FE2CBE1BEE77544E140
SHA1:	95A1254AC19FF1D72E6AF8F5D61CAC4AFB372103
SHA-256:	9B4414C672D10E7341869103D95F8A5DCC89CD3439054FD6B0F1E534938FA523
SHA-512:	7F3AE018EDAF013BCB7AF8BEDB057A2FF48829552C400F7458F6201FAAA73B5CEA36CF4F6A49F81142224DE5DDB61BD93808C7A4BFC31ECD4591D54A01AA7376
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7440be935bfa443ca1d03e125709c9ca.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:71095KAfSL0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388266022601953
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6b+2vYXkVBng2jswK:SbFuFyLVIg1BG+f+M6SdMBg2jLkGq
MD5:	45CA36E641365C67C47090744CDA63C4
SHA1:	37DC0D1EF0E8439066AA735895F0D37215CAFDBC
SHA-256:	0EB18C54F788E57A0723B1BB26C19A6A9A02AFDE14D6BA5679452BB0800C0F70
SHA-512:	D46194D3126E55FCD8A3F64F453A18351741FF089665A6E32812A36FAAD32655EC248C861EC72A726F39B80A897099F6F13BED7C247713B9D7AAE01D1B7FB0CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03901deace5a405fb6a2a63c0641c487.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:711692mZxP4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3991630274662805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+dDEH1cnFXQmXsjsc:SbFuFyLVIg1BG+f+M+dYwWVjosQu
MD5:	8A52426383E7ED30B8DC3B6C2CC6E2C7
SHA1:	E1492FB43E0FD2F7D9F41F80FE4E6714AB6DD762
SHA-256:	FFB39AF2A3069C905313DB7DBCA4606C86B17C318B583E8C45617C167466C356
SHA-512:	AAA2A78FAC4560C1324E80F8DD23D4F058AF541690847E7827981086745EE3D6F7EB725106584F3700013F5B706DA81FD15F3EE520A4DF066C0D6BF9F3B32C7F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44ce1469c60741b8b7c9b4db8b26e490.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:71753Hkspr4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.526349900246895
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoAoZlEmvWaATji4s:qgFq6g10+f+MoVbEm+hxs
MD5:	DC784C0299427A3B67096B8F178B3CB3
SHA1:	A181B6FDB209D6A176A0BFB88449793F984183D9
SHA-256:	99E9C74468617D3C9E6B7361F10BBB25CB4E9D68A04AC54F176BEC1B034547FE
SHA-512:	37F8D028DB190A5C5924972BA802AC39BEA6F5538833AAC9C05F64C0ED93D9B8B9C19811C2B7506439636C5B4200428C64A74A52C105FD193038B600F6B88E41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b25ec5e0291e4fae8c7f6b29b4de5f9d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:71755rMokr3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.460317582133964
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmr4EMHqjs2BbQIeXGu:SbFuFyLVIg1BAf+M0EMKjNdQIeXD
MD5:	BE462BD77CBCF4BA14B3B8DE929CF8B6
SHA1:	D23EA8BA9F88280F53891D9056CC2EB7D371E878
SHA-256:	B056BD0DCF4194DD3A06262DFE32DEFC013A83C14CEC07429F935F1DB0313540
SHA-512:	5535414777E8DDCB5FF07A10430D4B227EEA046B3A4052DD903EBAFFE2167C9D06E1FA45068192E778A70D28B04B7A2B012F4F18B2C541F7BCF8453ABF178324
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ae89b743f83d48bdba4e9827331b6e79.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72713xtRCHp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.549682942927927
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoHc32lY7dQSHjs7LH:SbFuFyLVIg1BG+f+Mo8GcdQSHji4s
MD5:	C959586C1B6FB3D900DE0F3F872934C0
SHA1:	575184C221CFEA2F35E90B07F823411BD59B0410
SHA-256:	0A379F17DDE35B26486347B9E8D22D9A695DB31E6F113C869A3A28EE58FD1CFA
SHA-512:	84C3054B8FC77BB94FEA3F869AFDAE2662E1AF1331F02780144F03353453638BC09BC8F2182BEFBDDE759B3075733A0D44F952001CC4DE05F216EF3CD218D9A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b22927e2f9df44ac8418c7856e697c2f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:727145rFduq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.449691247270204
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MaVpemiRqjZcHcljX+:qgFq6g10+f+M0pemLmAu
MD5:	A16FAB02BA5349C40BDCCEDA351498F8
SHA1:	DB42D9415CD062E5625344AC09E06ABEE0F07B23
SHA-256:	BFF2BBC7D82350E4C31A5FB21303A23229197BC1E42D4B9E0698610F149FA497
SHA-512:	9ECFEA72331304E07B05A16710AFB90CDB55C6AAF0B69BA304664928D1BC4E224759B50B993A0CA55BB912C8FA7CF13E5E9E51CF4B376F8289284DB803280132
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a31c863929a04ee19931bf04d436ddf1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72715dm3ybu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.418081611818423
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoZCQEM3jBw1Jvsh+U:SbFuFyLVIg1BG+f+MoZCmu1KTjosQu
MD5:	B18FEE33C7F785C35057EDB421021858
SHA1:	D1D83E01C3E10E093689B931CC28F0B7D2735CA5
SHA-256:	91A90787DF27F92FE40CDABE6F7A1524349720F294F66F67C0827006DD20D31D
SHA-512:	59075BBEAB1E59F596BE71E1FD5B998794B142B49D2FE05DF1BDFBC58F5F163887EF73181C545ABA3BA76FC0B47CF71BD5C935ACA2B7AE2C7668DEBCCE52A753
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b783275a29e74113a240607b025298d0.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72717VGPGOq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.434848157649434
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpuXRA1SmNugrqjs16:SbFuFyLVIg1BG+f+MGm1NuuqjosQu
MD5:	C47141A1CB5AD9038A1F7FB17E1B7C19
SHA1:	53E4A0F918092C043E22112F2D9904367F5309B3
SHA-256:	78A127FFFFFBCD007161B327F4CB1F10F57CD7459D45017AE3945C4774814864
SHA-512:	3ABC3744262EE9A1910774ACC7B149C0AA43A4DA3996E5739E7CA54AB4B918604525E2C0F0DC6C918EB90D0A8CFC3FC802992516C6D2FB0D3EEC75B7361C8A55
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8cb233e56b9487db76b468e7114acc9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72718ZH0etr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.444357096139802
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9hSgFZT4vBv6Agrqjsx:SbFuFyLVIg1BAf+Mmx6AuqjNALyAZD
MD5:	66C8FC899C57C32A753A436088434C37
SHA1:	CC13535BA6B801A444802F01B9A0B6DD69EB3519
SHA-256:	F6C2AAFDB3C6C67A748F01C4541FDF11677FE3ED0BC9E4F4F3638ED1D5C58A75
SHA-512:	D5A807C50D32DABD639669BDD946276B505895403B7588B254CAA13EA5D0A194A3EE1A0791768FB0801996F2F88DE97E8413C3E4B97B36F57B15FB67B12455D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=74b74c8b7e1c4f6ab19b260bdd25e1e5.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:727249tn82r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.490952935901101
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6nCdji9jPv8jsicWg:SbFuFyLVIg1BG+f+M6CdgMjZcHcljX+
MD5:	F78376E91EA82BD1423FE248B441E23B
SHA1:	C0DA85E333504B2C34BEBFEAE0A01BFDCFE860B1
SHA-256:	A503F9689339EECF9BC2B78E3A29CB518A8D7CC39A8C888C9F16B51FACBEC4E4
SHA-512:	9608F720D1896889F2F49CAD7AD53E08B0C1B167CCE27DAEDA064FE6DAE8BD58438651B7DFF488475812E4EEE9326D76B532BEC7963ABE0DDC1BBC62F7E8DD11
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=093278aa44a34d7eb3a92fc856e65f0d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72736gcNz6t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.477623195661942
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/1FRiTdOsjs2BbQIeXD:SbFuFyLVIg1BAf+M7gRDjNdQIeXD
MD5:	F084779CBB52785D509E5A1B0EB6AEBF
SHA1:	583F392279C7F05F772883AB1DD1E893DA7B7D79
SHA-256:	A1B2033EB5A3EB68ED4A1C45EFA0723287E1BD027F68B8127E50F17485017839
SHA-512:	4DFD722145FB637A1CCAD63A2416051C42E3E53F8FD466F136DBF6205E7DC948AD17E4E1E7C84D579F496CB38DDB5A7A9C64C40E344452CAE69CDB8739190929
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b76515c89044e30afe07af14fd78723.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72738igAyHt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.523037299385969
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/oTHdGPHdBLO4D5q+:SbFuFyLVIg1BG+f+MQTHKVOO0ji4s
MD5:	E4AE5740AC9A2F0B206F8ED010FE0F8F
SHA1:	1B013F6D07D957B03E462A1180D5EBEC5C4CCE8D
SHA-256:	3D5A36A2A5B200CE6866D27A20650C8F09A1AAA89ADD5CB8EE75C5925064D91E
SHA-512:	6DAED302144F0CC6C817455D26504C9AB8AECBBBC800B43408B6B67AC5D0C94EECA35D07A845657136DEB7B51F9686BDD30F409B666469AA1F1D8F5F19228E2A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=58cec31bfdc1407b8c014569cb095e8f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:73432cNoFTs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.531266168822947
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm83x3HX2js7Lbgwzxd:SbFuFyLVIg1BG+f+M8hn2ji4s
MD5:	80B4A36EFB5E2331A2192147D02C3C2A
SHA1:	E6C93EDDE5629FD0D2E107210DD52D506B202DB0
SHA-256:	358B7A596922ED3502DA70C46618620FB48F1FF2DEF51A7DE7655E51EA35F6CB
SHA-512:	D04A56F3111D513083813D7E0E73A38B3D9630DD3F99763B8B076D44C784E1FF95DA932CBCA2D710E1C74B65769C001E58B9EF61426B10C0005AFDF7F97B0076
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68b0ab3224bd49b3b3e21669a05b2927.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:73433wvMIHu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4972566720279765
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MupBmhd/F2jZcHcljX+:qgFq6g10+f+M8BY/qmAu
MD5:	50A513AA3FAB82D34B257FF3BFF808D1
SHA1:	419967A26080BFE2885188A6FF6A5B6C9E461E56
SHA-256:	DBC0358610AE2D96358A691C64FF4A3AA02C2F82C3A376FBE05346C173859D48
SHA-512:	391F5C35702368B7834BF3797C42B9475E8B03006551E0456E4E48260D7B0E37BA64178927A091DEFCA2BE6A3D86993D86553917CC30B9AA2F93978FE10F1B45
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d283ed9242964591b68cafaed4378963.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73434JvT8Lu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.390870365148176
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrDRXahGgBZdWTjs16:SbFuFyLVIg1BG+f+MRaQgBujosQu
MD5:	C39E7A2F6568DB8AF2E2BC7415255BC1
SHA1:	4CB67572C84AED1C77D8678F4618DA7BBB6B8E89
SHA-256:	D712BE84C16AEBD504307B9F28F985CCE01CA3DEE8C405A62B93A9829FA5D908
SHA-512:	8A15ECC6213BDDBF81238FE6A419B3299AA3E81A79E8B6B87F9D5444C659081B4CD438AE38DA5DB0B2556228DAD4F22F758751FB25F6468F5923AFAD51F1F38B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3ac07f8db264dceac2f728dd6f1abc7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73440ZqDrDu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.432665233797737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm87Gde0pdMqjs2ALAXaN:SbFuFyLVIg1BAf+M8CE0pdMqjNALyAZD
MD5:	C1312312919D3C52500739B77D957E98
SHA1:	28419C120837D4DB8FFC6E799FF0B7201ED2CB08
SHA-256:	B6ABC67CA96441B5BD00B6D3437A1C022EA7575C4D75D1362E1A1876620AE775
SHA-512:	431F8CB6FC375C7FE93CFDC68DF9188D83113164112D2DE89359FC0A005A942D0EF7B015F3EB33173EB7086AFD458F61136FE9D7B2EC2436B9625D89DDD6BD5B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66acc8b7d3ae464eb27bf6a39d87fd47.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73441aezA6q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.455869212411786
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm61RXZcxUKEvFrxsjs2y:SbFuFyLVIg1BAf+M6bXiShv8jNdQIeXD
MD5:	C34533174C0A5BDD9C44299ABB84929F
SHA1:	E2EA89AA853ABEE9AE85A8F7789158A6ACAB82F3
SHA-256:	E4139C12FF0994105B9482A1672733F88C52FBC39EB13B55559658038E505109
SHA-512:	E8F9E806F8094A0105101AB312288F7AAE8086E2D05D45B203C8672D64FA1CE5E52D9ACBCA233CB34087EE5AC412C2AC679AFFA4D006B7C89B99BB937C3AFE59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a945b11f95545719265e404a1c8a152.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73443SGlk0u

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.551214065754366
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvAx6CrQJM0js7LbgS:SbFuFyLVIg1BG+f+MI4iQJM0ji4s
MD5:	FC4042D90C3DD5673EF8CB4F5B495B76
SHA1:	0006623D3116A0CC6EB7D6CC12DC21A55407AA72
SHA-256:	4D8F4457CE5775A62F38D1C79DD89DFC0DC3F729D4857AC00749627415D278EE
SHA-512:	5ECC8AA49D20D51065D8DF0631E1414DA1C3B02685DEFEA9C921503B2453D08C5A779C634E65C82F57F1620FB2CE8392C1BC8A407AC6E2B57371F752822CE3C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ebf3689b7a11428797ca59a64e5879f5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:73729jStt4q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382592075815578
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7DbjAEmmTSGMrxsj+:SbFuFyLVIg1BG+f+MHAESojLkGq
MD5:	4FDF5955964D6D68DFFE5096ADADDBB8
SHA1:	A53754443E85C597A4036BBC735B237498ECEE93
SHA-256:	04ADEE43E51A1429CDEFB4CD25B8CAB83A598B33441166BBC823AEB839546188
SHA-512:	B95FF4946925ACACD7174BB94256F14905D31320B0F34A00F93CBC2EE9FFFF2E14605C0A8BB00F3421626F52A82F62BADFA44A3CA91D0E824F808009ACC72CEC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17709e83cf024850a63e7766cd367cc0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:74234foXG7q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38905831604609
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmocyJIQXRjA8Zswsj+:SbFuFyLVIg1BG+f+MorRKZjLkGq
MD5:	23C0E1FBD35550700B1369A1768BAFFE
SHA1:	2656307B5FD14FAFD09642DD93D1A890ED47FBAA
SHA-256:	FDC1902CC520E738481C3224601EB9B82C6F5B4008AFB1AE9802B76B3E5CB9B5
SHA-512:	FB4E5773F0A3EE1CD09C786541C1C03FB523532568697E6795062B28939229EBA2F3F2926ED90A53AA95103B2EDCDD9630128617040093B287E3303348EEC57A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b1f20c6f0b3d411bb51e0f42297ea03c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:7465123mePt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.391617133617307
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoQQREABXdFiX48jLkGq:qgFq6g10+f+MoQEEAsYT
MD5:	EA2B00F85EFC4F5233C6EB21BE74037F
SHA1:	A1962A2D6D98239A11F19DBA74EC63E449591C12
SHA-256:	E4F5573E40771FE9A5B3746A31DCE489D2820C43A5C69A942657AB4E6D571737
SHA-512:	369D8334027F6C5059A020B4C659AC6913C34CCBA47ED790981341A9A99B82D41D89E85AEC1BEEB5B0ACEDDB75CF9B0DA62212EFF933E79146A4E66AF090975B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bad40baa077c454f9d2801c7ae848f2c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:7523563H8ev

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5158909852898566
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6RNox4Dv8js7Lbgw3:SbFuFyLVIg1BG+f+M67U4z8ji4s
MD5:	8E7DEAE4D041FABBB41B3EB281070CB5
SHA1:	082CA749354D177157FE90E545C64EDAD2D991A9
SHA-256:	68F2EBD3E6D34CDD412363776C7101352AA045CD052328ABF8A83D6A682A83A2
SHA-512:	3E60A24306FF6084112BB31517BBFDE5376063D8EEE5D6E893C30CB4FF7EBDDF47CFE9E34B55CFE45B42F3EDE341501F8A90AD8B6DE56F8AC923DF16450225A3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0639d80824a549f48ebd1d51908bdda5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75236o04Gyw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.48401753846778
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MegcIHiWU2jZcHcljX+:qgFq6g10+f+MegWNYmAu
MD5:	6DC48CA7A74E9FD4974D1B5C86FB5059
SHA1:	FF5FC3EE753A8D1FA1F37944FE074E016F032A48
SHA-256:	BFF853D57205636A1C8AAE7CC9C1AB1D19A56512F4A8449F09821D30FCA3B0A2
SHA-512:	093551FB239685AD15CDD1F59D9BC17918E3D55A5FE88F6C865B2261FA1833CE8EE907E7CB2D59F37385B8291098A9D5B2AB27C53E578D26DD8C2D26789E3D0F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a225605ac9864214af9b62c32c6d1e04.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:75237CRzT9u

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.440053817063914
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuoJYyg64TjF2js1Ha:SbFuFyLVIg1BG+f+Muoi2josQu
MD5:	75F802010FC4CD336A2788FF230600D8
SHA1:	9810DF1ABD1A91022F630EC36EC40444BFF5CAC3
SHA-256:	379D6347E3CA9230DD37092437F65F704235DB9375C102F6BCF083EF91BED558
SHA-512:	A40B8F374D6E7211471CCFC91386F6746BF89D7774947ED46C49F60D6A13C120DA19E26418E804F86A97456F3C7EE2926D0A0E1DFC321401D5D1A54B97DDCF95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ddc8f7e461ce4a769a2fb23c34881f66.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75243oVTjpw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4106084031036925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9CrDCKkQnHck2rxsjsx:SbFuFyLVIg1BAf+M4rDCZQnDjNALyAZD
MD5:	66095B2A872AF2D416CAB4DFAB9408FE
SHA1:	E6DA6A77BAFA452D53A28D2966FEF47355BF835C
SHA-256:	E3F271C43C13B5DE83AE1799BDB7B582EC1236007F9F6A6C0AB3549B0249DB88
SHA-512:	F58A3D8E9A0799934025F95453458F8EB1B3E4E16B2F0A5129AE89112999F2DECC52FAA3AA45D8DE0AAD1A84D8237CE1443664066A4DDCCED66B20D4620A0AC3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ee3f8f8f79a4baebc2c18750e922fe2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:75244Z3twmu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4735722337080395
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5/gy8FHQLNsMqjs2BbM:SbFuFyLVIg1BAf+MVmH++ZjNdQIeXD
MD5:	FBBBC1238A6D21BD1796B8989ED845DC
SHA1:	AF4AA10EE25C06577C511B724187CB901E48B7D2
SHA-256:	2CECA113AF6671D49FC7FDEBF42C7B2CDFC72F4D57E26E5E9BE7B1AAF8C9EBE4
SHA-512:	188F7859804D4CF85F55BA92AF9BB84C56C979B303D56F67CF8F0C745B21EB7F8C0A3A118ACA946D823A9953B8930BF38C571B9D6E2F68F7C6C6E6575B1F1721
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35e002e7b31746c19b955b58aeb8dbb8.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:75245MwL8cu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473997559257176
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+KWTDmDWWrqjs7Lbr:SbFuFyLVIg1BG+f+M+KCDmSWrqji4s
MD5:	41DA98CE0C174D9E287A6092F11FCDFC
SHA1:	5B0497EBAA7B3DB2D1CD7A9D5125C062308CEA84
SHA-256:	A493CEEBC06525784954E59D54BF2717FA4CF9BF771487CC0FEB2FEC22E34B40
SHA-512:	26CDC41FA1B29B289AFF7449F95E2C07A3E24F2EFF120CED5392EC1C1B21E559397FDEBE0C181F0682A4D19D17D38FF14FE9B73549AF1008B97F206634F9A4E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=46c5f6d4dc5f459da7d5f666aa005805.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76364op3iJu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.510047335119542
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpM9M3cWxHG+sjs7LH:SbFuFyLVIg1BG+f+Mu9M3cWxmTji4s
MD5:	84BE212F0B7141AA76A36748CCBB9B39
SHA1:	BCA3FBBA3647F109DAAAC214A880F3EBCA8DE605
SHA-256:	35D839AF2BACF058383BD2E07C2E16C78DF472662600E945607BFA4EC3A56327
SHA-512:	865D2C62E27C465A79A97973EBD6EC5F2311B2EDFB2FF289315776D49965996371251469052B93B7B2E1D182ECC40DE9F776050FD494B873E48A05AE0A4E821A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3386afb6e50441bb6449163abccbc2c.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76365rpukHu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.45610067733107
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M3TSVyPUDnkqshTjZcHcljX+:qgFq6g10+f+M3ewPammAu
MD5:	D2F1603167BAB6921353A6B166222D21
SHA1:	45C133C5D31F0E7D7EE8AB4E7848A882949104BF
SHA-256:	2D1DA539737F1B6123FC285597E8A0775A6890DC4F0B16E676F69CC17A0FFDDE
SHA-512:	813C09384E44F8ED0399919341221CC7EEE02D49D675A6054B767B6EA653EB4D947431A7BDDBC9932D748DF2C1EE689F6496D682375B8449D4F809A0D8688DFE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3cbc067060624c3b92d1fbb211eabad3.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76371MJTaJr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4364070175365535
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm48cEZAURWfVTkKlsd:SbFuFyLVIg1BG+f+M48VbsBkFjosQu
MD5:	7982B070C39BDBC9DF3073D92A26BBF6
SHA1:	338F06C3D98384521036156C1A80323265F21A54
SHA-256:	E36A5CE217C7726D789625CD5498FBD5797A8B38CE8CC7D4E59EA2B3B2ABDA67
SHA-512:	E380AFBB766B7546EAE973670222096659D10162D5FAE4C831EE6CDF4465567616BE76AC01B2B829425F7059BD9507D7691F3158D51DCA84F5C84D12561E0908
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20393f840e83463893c3664b0c1657a1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:763722urB0r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.409195770866307
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpcNTUVRT4t0tYg2jx:SbFuFyLVIg1BG+f+MqBUVRpuTjosQu
MD5:	862E12D482506D2AD2E99C8F2810235B
SHA1:	2F7669D17AFC307D640C04CA5314A708C80BE029
SHA-256:	C5E75F47AE0C24BB7DD3499DCD9CC1583BC2D1492159E094E06D9CA5C3DFD611
SHA-512:	55E3F8626BA0FFBD493E91CE84B87EF2A57D1E5E732C46D47D4B2F11356877B67952FB510C8BF77A17D50817883CB8EC89DCC2B6D354921CDE0D0F2BF914F1CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4ec1191161046e8a07155eb527dfde6.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76379GqF8xt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.451822793732518
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyEhHThpgRqjNALyAZD:qgFq6g1af+MfHDgRwIZD
MD5:	3BBD54FA899990E0924A49EF3B9138F1
SHA1:	002BB62081DC7C2004785203BE751B7F79F13017
SHA-256:	B97DFF6BE214A863F258F6176AB9BF18FC9EA971D6B57498149782A1E3884B72
SHA-512:	EA782B680311BD483B84B317D33F50A43A374C4E25B9C098ADB06BA3C21CA872075013F1C28DDB4F4CA7D34EA1737B9A94D6C3E9F83492C365C5165C38487F9F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=821f9ab26f1340d2a73b679b31d0a48c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76386uiga3q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.413397513271925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvUhQRkZE2Kzz8Y+sjsd:SbFuFyLVIg1BAf+M8hxHZ0jNdQIeXD
MD5:	23D0FB70E6E5E22128E84E42E7D6874B
SHA1:	C3EA4709C0D4295BB5715C5A10296758303472E1
SHA-256:	E03AF7309A88E0BDC4490F53B95E741578C747D2F93F5855ACB9A8E3F9668EA8
SHA-512:	2DC22507C6D6DDB12389FE062A93B263F0824EC6F89F946C220F4012369891AE37A197B47A3D794302F882C055A7E38537D8FC01D9D8669184120AC75EB9606A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e364312e47f3431896ae6d438d404003.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76387TMHdtr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5431720972178065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsVOVMrXHTGFlsjs77:SbFuFyLVIg1BG+f+MsVmYSF2ji4s
MD5:	7E2C1FE43F0BA2A9E8A0C3D9F84E64BC
SHA1:	F4E2CE734CAA983A66C09C96C952E0790A326B48
SHA-256:	E7DFA980893D33EE20416AFCC41A19D0A30439ECBE1B740207EDFBE981AF262B
SHA-512:	824DE395DE5654C76798A9A71CADA4BF437900A1F87730C0CBF07369A9032860508C3CD8F9FB93263FEAA22841D7894600B38AC35279DE8A4FE8D5E683EADE9A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8bcac4f25f749f49f7b61177d40b66a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76462XlHisr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.41898890493639
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpnRUq7G+BG/SdYuqS:SbFuFyLVIg1BG+f+MRyq7b4SdYTjLkGq
MD5:	ED521AE0D222735F6684D68ECAABCAC6
SHA1:	6D79880C54079705746FFDD0FFFCFB609B4E1F3A
SHA-256:	EF893DC1EC37CF95EF7804E47E527ED79D62A44985119FC2AEA76910DEC83C19
SHA-512:	8F449FA2FCEFDCBD52363E0AA701ED6CBE4701BD7103A5619FB1C01E6E72D610483F4BE92D91DF34EEA25F65EF98892CD58F7619661151DF8ECF0F5E4CB4E6C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c668c7de14194a9f8e93d050c3c75f78.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:769369fDF5t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.405191180931853
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp0BWX+hGc6n4YTjs4:SbFuFyLVIg1BG+f+MeBxhG60joa
MD5:	5E98B3CA61489D4264961CF215E4B75E
SHA1:	C89B44F5E1DDF1C01F09AA8DD7E7620AD0EC66FF
SHA-256:	75A03F6ED37F371DF8F31CF6D3BFADFB637BE74412085ECA8D313E0FE0FF4E74
SHA-512:	5BADCD108620611443B1DF15A817D6A74625C0E278FEAF46D6D59A42E20D0B8BCC941036DA7D2868A0DC36747ADDEC9A069D10F87850FC5C8026ECE84612B1C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce472d3032014b5698479a29371bfe48.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:76946ZXSvgt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.326509711548744
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6LldXyEESWXAglsjt:SbFuFyLVIg1BG+f+M6jXyg8Ag2jtWL0
MD5:	0A5F22D825BF212F6F43378CAD75B20D
SHA1:	2EAA7BE8D83A03B577A213B2070C38A1C4D63958
SHA-256:	0E7A368557E6D3991071656CF6AAE6D3A77218EE158D2FC014855FBDF282862C
SHA-512:	B042ACD422410872B7F0F93F3D38459DDC1D3FD1257E406232ED0CDA979E7254B5D8126414A62DB6DF26A9F8B5E4AD2B172F1C5BDE2F6E7E65AE2421596A4E36
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c94f80db3b344a49aaa7345075a2c23.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77065ac00eu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.413776664112524
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6T5WGn73SUvh+sjsx:SbFuFyLVIg1BG+f+M6z7iUvZjNE
MD5:	2E8A1D51584C0DE07D2D145FAF0BF862
SHA1:	AB390456146CB0C8B13B3D75CFEEE9869ADBA899
SHA-256:	23FB4168E331B3206F6188334F6D00F56F3231A61FD39FC8A0B45743A52743F9
SHA-512:	018E18444678E9873767A6C09F13453279E6DCDA42BAAFC4357185B3A8CB7D954A6929B6C7B2BD1AA047C85C4D614863FEDE96D163CE04F5A1F4E2BBC4660943
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0cc21dea535644de9d6000647cf0987c.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:771655OHjYq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3813885286466325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyg3dHRUcbEyEvsjs1:SbFuFyLVIg1BG+f+Myg3gPkjbVC
MD5:	96948ED5800BEDD6CD02CE084A086FB9
SHA1:	C3926246CE86B7AB4FF04E4E8E344232A63E5D0F
SHA-256:	54C7F391BCBB54F1C0DF083FD405695D8DE90EB3EA96E4FC114A251C1F955E6A
SHA-512:	69B0BA2B1E60A0427B1DC1C189C42003399C722DB9610FAC0D1BAA4D700B45352E394A45F1C5339FC3473E3D1960BEC7412BB91E2D10F98AB5B57DE4F9E98058
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8d39d9ac01ab455c8fd29eff21a08c0a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:784044ZqH0O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.395795727508823
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrSEb4LK5tvAglsjsc:SbFuFyLVIg1BG+f+MeEM0d8josQu
MD5:	720BB9F53C2D2349763B62AFC8154E8A
SHA1:	ADABB868DE6E8785844C3C1A291BFDF9CC576DB0
SHA-256:	1E33C961F1966417C0C22A687B55372C98553283E6B7AAF154D4CA182685BA0E
SHA-512:	EC88F319382C87D807217B4E3FDD7010080E532F3CC9D28FC4FEF5CE78BE28935A28B395F920FDA84DBA7D5D2BB71143975231F524FA50968AC8226DF7E2CD37
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a85a39d12df24ed38fccd0ac506f42aa.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78406xko8FO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.413314323973126
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzzAz5hcmQhATjsjOA:SbFuFyLVIg1BG+f+M3Az5KhATjNE
MD5:	41C656CC3AFD10263455245CE96BE657
SHA1:	417A4D7BBD66C675115E87960EB3D10B4ADCE1FC
SHA-256:	679528D57381D181D5BBA9308E23897177E599A9A88C8C0E844BAEB8CFD4AF64
SHA-512:	FDCF4754CC7FDE3CF18D282695B57E4B4DB7B248C7A9D30F2E1FED2DA9A9689ED8E4379C742BE2789C1B392AC8CDD01CFE09008846B099AED2C4AE0FFACF86E4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97cc50c0fd9c4f39a5d292423cf12559.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:78407LVqA2P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.483458660938625
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsAfirHeSqUvsh+sje:SbFuFyLVIg1BG+f+MstajZcHcljX+
MD5:	1102A254D2ED1372A3B4F9ED1E064ABA
SHA1:	948FA56A06EE66A0FDC13DA3EA42BA914EC2BE3D
SHA-256:	A4839597D8FEB957E246887349F8C5CB47A04B32AD3350F04166CBD3920FF769
SHA-512:	75437923B0BEFEB243A75D7CAC7FFD2B8C842CA81115FDDBCC132F27B8E8B5A2DC239624EAE739CE9A61E7D333729395F116904602EE63F43348F161674701B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe884a0d513e46fd97350c9814bce643.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:784084bWJTR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.433851394510846
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm90dWuczcWAHcWieZ4:SbFuFyLVIg1BG+f+MydWXAwejbVC
MD5:	50C460BCC7A4F99814D65267333158E5
SHA1:	DD04EA106116B7DC0BFA4BB7B45E409FD5DDC63F
SHA-256:	F12DF971141C025B85D6E41B61BF709580DB36625A2BF55EFA628258249C7ED3
SHA-512:	C32394260B1F4BBE54C101AFCF5CEFCBDC72C966C9CE057758283A405D1C520CCCE4C407C82293EFA279D12AD6D3F74F3E8742FEEF6365364D236FA4F8289A1F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77b83789fc7f493eb92cadd697e5182e.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:784096ExfTP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.389865271131642
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyGWDYTVDJhITVehum:SbFuFyLVIg1BG+f+MyGE+VVSTEhTjoa
MD5:	8F2239CDDF60ABD71FE9F5B0F25A322F
SHA1:	81CA5E5BBFFB3AA6E705C1DD351E9B35F6CFEC85
SHA-256:	8DB714D13DEEDDDE5E423819E1E97DA514B604A3C4D7082A15016AC6EBC6E31B
SHA-512:	F8046634F73456208753DD43B36F7A0B5D8AB7F8D4CF1869E791E2F671F0924E6302F2F207F09859209654044A4F9C5A4E4902DFABBCD4B864E808063F9BED4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=893563f9552d460f9af8bf0014313478.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:78410jb8omR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.519476076970523
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpMKRrMV5qjs7Lbgw3:SbFuFyLVIg1BG+f+MEmji4s
MD5:	ECC35379077AAD2EE15A846ECB974A6A
SHA1:	0DD274E1DFD1A3728CB9942B08BFD06FF26501D5
SHA-256:	0BB1E238F76276EB84D0FFF7173B74ED1678BA6122BED986CBC6842EE50A2D13
SHA-512:	07CD1F38B3B6A385A54F8F15F829AD873D75C5F0551F8570052779ABA5C74499AC012CA28F0A2C9EFB091D4827302413134E8157EA475652FB8A02E372AF4F7E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c31e4d08fa534d98abf0986d5a634744.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78412NmFKTQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.498386899643826
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MvpmhDdV0ZjZcHcljX+:qgFq6g10+f+MkHVimAu
MD5:	FEBC93BEBD03DC7B8990E639DFAA0C27
SHA1:	FC57E0CA0065F14B1BA8B241E2541D8C121D954F
SHA-256:	3C847E1B8CE650A67BFDC1A4E8141914549342B33D45E23B128A7C23B2F554BF
SHA-512:	EC40F0C033E4D7333E172498ACCE3F9A62AF4FE03A1B9DAAFCFE00AC1C8363C643D8F5909E2ACED369CD20EDB86650228CBCFEFC8B541B1AC140DF810C5E12B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=772de4c32dfe42c488f933bb77268101.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:784133x6HjO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3117186527661575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvwUbGAuhwB290Mxsh:SbFuFyLVIg1BG+f+M4hwZjtWL0
MD5:	A140DF675CD6B3BD109BCD70FB2EE632
SHA1:	90F09367F44DC4F9F13C83967274C9401A25E63A
SHA-256:	FB8E5CFC5A7BED8906FF366812632992BEFC28B580880C93F2F840A9D3ADD8BA
SHA-512:	053D1984102244B5410ECBCD0A82D1F852A1836615D9C2FEF81474A1E6F8CC7D402574A72D3DDBD31AA1C149BF0B215751493BFC272D5A18075520D22395A80B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ee019432ce104c458cb8943d4b2eed30.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:78415yUNB5R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.414049820060754
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MopNoPSRMqjNALyAZD:qgFq6g1af+MopNaSOwIZD
MD5:	784489B3BBF59660B8E2EE53417A0987
SHA1:	B5FE70C3C6C656D1DCC1D002B1A0A15CBBC463F3
SHA-256:	C6A1E16FEC982DCD75E38B8C9AB687844B63737BF29F76EA973A1322C40800F4
SHA-512:	0677C4A55E06B8C0EE78D91E51EAAEF1E994540387330C59E0076DE957075F094F3DB8DD6FC5428CD77E4DA181D7CA881D6B0D2A3EA17C6048F385B72B7F8F56
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bcf8ec4cdf444420b98d670fdbcea23e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78419dg9qIQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.434365715764845
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGfdjX+aSmBy+sjsc:SbFuFyLVIg1BG+f+MoGNXJ5KjosQu
MD5:	C574ABD3DE71A089F3C18B6EF1266E07
SHA1:	15AEE328F4AD1C22D06FFDFC9CA0AE750C2586D0
SHA-256:	D8A41A34B3C9C3FBF7DDA965994BF0A015087E731E86F637D53EF202C4FC77BE
SHA-512:	2AAD09F692B355EDD9E116302F6F11C2474A4FF0D59FEDFB565E61CD2719FCDA81D0FA5DB128572F2C2CD5A2AD808D877683DE2FB0FBE902F331130E52C7F0E3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b3dff881c0294a959f628a485eff8dc1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78420Dr08BQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.445168881941812
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms3BtuaT9DQvF2jsjF:SbFuFyLVIg1BG+f+MsxtuapD5jNE
MD5:	B5AD83A613C4410FAFB83566A1767D18
SHA1:	CF194DCFCE90B1D37E9B58571BB9091C46C5A541
SHA-256:	CBF19EB1C9FAD859C880B06130498900003625CB2F45A4F47706A6E3097B10E0
SHA-512:	9807B4A91F7C1620FA09FA7F41639965A8B10FDAF6B982766B5C646BF345943A763EE2092C792D324F31349D61421405B7A618DB793AEC37133BD6392D7AB35C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f9cd28803bc748e89e629d7749e493a5.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:78427sGN9qO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.425999489757495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8kEmGqNHYoRZWdhhM:SbFuFyLVIg1BG+f+M8kExqNHvZNqjbVC
MD5:	0E4DE81D5ACAA218180EC1A632D528DC
SHA1:	DCED23AA83B744E8558A47E0276545F8D1ADD3AE
SHA-256:	BB5CAB637290333A480659298F001559B60A1026677A4329AF73D91512EDBDD4
SHA-512:	B3EF0F16AD0B5761655BC6F03245E2C47DCD713F3BFE3824E4A485DA5FBE75AA1A563FFB98A2BC55BE05BA7AB347B713EEFB20094D675F9ADBAE34F3CAEA94BB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=690a199cbf3f4bfa88ecc7253a6bfb1c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:78428q55meQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.387489615731359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7CWQprcEBRyoFrxsjsd:SbFuFyLVIg1BAf+MeWQd7R58jNdQIeXD
MD5:	1D3B9BE6C407FCB0D423B4F50EC2903A
SHA1:	9811B5109522988DCA44B41EDA321EDBFC11475A
SHA-256:	B7FD4C9EB7818AD09B076118EAE72F89ECFA4F7D148AFC6A647BBECB5A5811E7
SHA-512:	B7987D27039520F36AAB20EF94AC1BEA3DACA5D326BF307E78F8F80681F018D70B7C329ECBA519D2C714E5E6229B33DA97D696F2F8458E3A3047EFF083E299E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12735e44ae4e4a6e9a56347447a43aa0.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78429FgDU1Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.345248987567903
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+ST3LAOXyxsjswkCM:SbFuFyLVIg1BG+f+M+g3LAOiqjLkGq
MD5:	E28D5D3A41C8E5CF6ABA32E0FC42F02C
SHA1:	76E12DE1EB9FCE3BD57FA89F9409CEEE91E140C0
SHA-256:	8278C1A3C7DD4B84CD3BEB53B69DFC2D5BE5B5B1F57529097C99B8F069C2A290
SHA-512:	FB230403685C2442B769D3C3B3D20AAA066292C06D5673A6E08CC24B92DC768D147AD53AB8738B292B3BF95D4EEE68AF8F65D79922A64224865807022917660D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=434a34d3e4644242a566b074c536226c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:784301NXa5O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.513257144468671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GgEFAC/67Mxsjs77:SbFuFyLVIg1BG+f+M43PC5qji4s
MD5:	DF62A6B7146FA035DAE6A2B182AD234B
SHA1:	A0D8C772FBE7BAD9AF9438AE29EF93871A158E5D
SHA-256:	D17BC7BFE28963C6B170223E3170B4D0BD47DD26C2ECDF8F96EF868DF2686468
SHA-512:	D2851BE21E491559D6254051572C829CC1A498501BB09A6672F4447F18DBE34CB4FA0CE907CA728D69B3B38860975E9B28A475ADF1446A3EE80672DBDBFC6A28
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c1828fac70342b3a1ef4729c7efb49a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78431itEBTQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.421696024734835
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoHeERrWmf8js1Han:SbFuFyLVIg1BG+f+MoHeEI/joa
MD5:	7B1E12D9178FF1D6EB43C0A75B4FF05B
SHA1:	91602E012262B28D58E73108073DE3A62FBCC893
SHA-256:	4F75FD5F8959EF10BF7ACBA0BCB5494B8720A8D65A67ED570BD4FEC60CCBAF23
SHA-512:	48879B42C25DB210C701A98E7251BBAF4CAC63A5625AAFD0BA256CB009CCDB07CF29DED9CAE49EAF1DF8F38CD5EE8F731A998FFD9597673A51969D035439C39B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5f1855765874970a4d0269f92f3ce74.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat01jkZDB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat02YgyaF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat055BR6T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0JUlak8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0KZGDrH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0QmCT7M

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0S3kLGd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0VjHljK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0WSWc4G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0XKE8UI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ajdTv2

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0n2Ny4W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0pHmEdI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0tz7BvF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0za8Vdi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:D2:S
MD5:	78FA70479D7D2C60FD29B7B09053C63C
SHA1:	5811756C3BF3A547FD3037071D4A3198AC0913A8
SHA-256:	B43AF71E437347A3BBF3BFDD7E228D9C413AF70DFA61AA3F2531E4C9C17AB4CE
SHA-512:	94A63018BD9A5265C0C090CAF94083C7A5932B1AC7C052EE5771BC2336C0A2D81732CF20D93DB448D80A17644ED557705D8F76932F7A58DF65B679664EAB27AF
Malicious:	false
Preview:	6931.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:1lR0sXlXEWtl/rLw:X+yl
MD5:	CB52DB6FD049FC1BEB255B8BE7C35F95
SHA1:	CD1854A28299DB3FA7AE735BAE6A63F490703AA1
SHA-256:	A0BC6A255EFAD311C9C04C223C520F261AAC20E1A9BF29890A834309BC1A40CA
SHA-512:	2137AF2CA88AF63103F0D141E5D93F950C2CCE76AE83C96642F5A3C6FBDF1771C97CA7815C79356285466C85B16A7DB3E383E4D87799AAAC3113CBE6FFC67734
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................nw:f........................................

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	4.871649922580619
Encrypted:	false
SSDEEP:	24:BIBZeLBZ4YfvTaEj0Avy0A2+V08pZeLpZ4YXvra8jcAvycA2+V0d:ugj3mC5vy5fV08I7fuKxvyxfV0d
MD5:	B5B92EB53FD40D10E1E3961F8B965ED7
SHA1:	BF09710FB90405E5D54CE464A628312FFAD47629
SHA-256:	00A2C1A8BA97DE9DAF30E7922A8DF5B7258B970935F436343C1A316DE731D72F
SHA-512:	F878CFCEDF68B72682ACDDFC1C9D431C855227CFB03886BEF1E455E0F0FC21514D3AC40200F462A6DACBD7718F621EB854960E98F8696CA3D4293BFA6DA61FB2
Malicious:	false
Preview:	May 7 20:48:16 galassia systemd-logind[6792]: Failed to add user by file name 1000, ignoring: Invalid argument.May 7 20:48:16 galassia systemd-logind[6792]: Failed to add user by file name 127, ignoring: Invalid argument.May 7 20:48:16 galassia systemd-logind[6792]: User enumeration failed: Invalid argument.May 7 20:48:16 galassia systemd-logind[6792]: User of session 2 not known..May 7 20:48:16 galassia systemd-logind[6792]: Session enumeration failed: No such file or directory.May 7 20:48:16 galassia systemd-logind[6792]: Watching system buttons on /dev/input/event0 (Power Button).May 7 20:48:16 galassia systemd-logind[6792]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).May 7 20:48:16 galassia systemd-logind[6792]: New seat seat0..May 7 20:48:16 galassia systemd-logind[6864]: Failed to add user by file name 1000, ignoring: Invalid argument.May 7 20:48:16 galassia systemd-logind[6864]: Failed to add user by file name 127, ignoring: Invalid argu

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hldoa7oet:F31lt
MD5:	F68B0AA6EEB34BC8871BADA588EC2639
SHA1:	44F204B64060A82FA6EDF9346ADB7DF9110DBAFA
SHA-256:	099BC0D0DBC88B34C99457EBC03BE52E5D9D435EC8865F35F4FA539689E3F065
SHA-512:	F7740458A120F84F1A5B826CD67435B30C43F9760E275D92C190CF7070B15DD9F49EAAFD4E778369069099D3C00B05AA4D0F8EA8ABA9D3018966C4C9B4D2F6D5
Malicious:	false
Preview:	LPKSHHRH..................\...F...(4..O...................................\...F...(4..O.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlOJrw/cJrA/ll:F3awwA/
MD5:	A625139030A22EB0B6BBB36AD1A6410B
SHA1:	9388F67F1AE2C2DEC830F099DB2A86CCC91A449D
SHA-256:	FC7F8CB680BA6804452E571A9753BE5C41472B5FC357A1ED918423E726C10C02
SHA-512:	4ABD11D16558743FAF058F1CAE378CEA324E59C2DBD0A6FC5FBD6C2BFC45FC8C0941B25286BAC8D2450D0EDAEE0924E93F877198711CA4B565B3F45D71AE6A5A
Malicious:	false
Preview:	LPKSHHRH................JU.FN.G.....p).T................................JU.FN.G.....p).T........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6108
Entropy (8bit):	4.735728969177296
Encrypted:	false
SSDEEP:	96:u1z22zuX2o2G2HGsPMlfv2fvavnz62Pf+kfDfCfXfMf8ftfCfGf6fVEfNfAuf7G1:u1S8kXxYD0h+C762H+4rCvgwJCGaipAJ
MD5:	A26E75493FCDC0C19CFC90F564E27810
SHA1:	B47E15F5D9570067ED2AAA87A6B4E3001A50B9D8
SHA-256:	CE1FB69BCAF908387C9CA44FFA3B734D9628C52E754BCC29DB09783EFB1E658F
SHA-512:	CA5FBD343C412DD2941EB980DDE3169026E18A32CAD1C4F9A60170108231BEBF274DECA0D43C88B1B709295ACD118EE9CAF30AC0F58CA10B824E279294079ACB
Malicious:	false
Preview:	May 7 20:48:11 galassia kernel: [ 243.805202] New task spawned: old: (tgid 6935, tid 6935), new (tgid: 6936, tid: 6936).May 7 20:48:11 galassia kernel: [ 243.947315] blocking signal 9: 5434 -> 660.May 7 20:48:11 galassia kernel: [ 244.126887] blocking signal 9: 5434 -> 726.May 7 20:48:11 galassia kernel: [ 244.170130] New task spawned: old: (tgid 6934, tid 6934), new (tgid: 6934, tid: 6938).May 7 20:48:11 galassia kernel: [ 244.170933] New task spawned: old: (tgid 6934, tid 6934), new (tgid: 6934, tid: 6939).May 7 20:48:11 galassia kernel: [ 244.182677] New task spawned: old: (tgid 6934, tid 6939), new (tgid: 6934, tid: 6940).May 7 20:48:11 galassia kernel: [ 244.303331] blocking signal 9: 5434 -> 778.May 7 20:48:11 galassia kernel: [ 244.478218] blocking signal 9: 5434 -> 936.May 7 20:48:11 galassia kernel: [ 244.648064] blocking signal 9: 5434 -> 1411.May 7 20:48:12 galassia kernel: [ 244.822536] blocking signal 9: 5434 -> 1411.May 7 20:48:12 galassia kernel: [

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	17504
Entropy (8bit):	5.081686866228532
Encrypted:	false
SSDEEP:	192:uhCubH0Ksmn1Ss8kXxDYD0h+RxEC7X62H+4HrCvgwJCGaidpAu7GLHt8GaIQGaIj:p41+r7ZQ34
MD5:	CB3E4CD4FD41E1CC720D2C8E4746E507
SHA1:	A43C9913E1E54A4F1DF1729C6CA891BF33AC88F4
SHA-256:	CEE1DA8F8374A3CA9F238669132143517416DD6AE2C525317710F91734A55877
SHA-512:	A2EB8C7313EAB28E373186E7027E65E0C83742B0626C503A1B54F542C2E4B6D4498EDD369EDF62C0865BDBD15332C5AC5BDBDC01089DC43D94C03A9682D2DF89
Malicious:	false
Preview:	May 7 20:48:11 galassia kernel: [ 243.519492] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.May 7 20:48:11 galassia kernel: [ 243.519573] systemd[1]: rsyslog.service: Failed with result 'signal'..May 7 20:48:11 galassia kernel: [ 243.672343] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 26..May 7 20:48:11 galassia kernel: [ 243.672363] systemd[1]: Stopped System Logging Service..May 7 20:48:11 galassia kernel: [ 243.673322] systemd[1]: Starting System Logging Service....May 7 20:48:11 galassia kernel: [ 243.705761] systemd[1]: gpu-manager.service: Main process exited, code=killed, status=9/KILL.May 7 20:48:11 galassia kernel: [ 243.710469] systemd[1]: gpu-manager.service: Failed with result 'signal'..May 7 20:48:11 galassia kernel: [ 243.710823] systemd[1]: Failed to start Detect the available GPUs and deal with any system changes..May 7 20:48:11 galassia kernel: [ 243.711805] systemd[1]: Starting GNOME Displa

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:1lR0sXlXEWtl/rLw:X+yl
MD5:	CB52DB6FD049FC1BEB255B8BE7C35F95
SHA1:	CD1854A28299DB3FA7AE735BAE6A63F490703AA1
SHA-256:	A0BC6A255EFAD311C9C04C223C520F261AAC20E1A9BF29890A834309BC1A40CA
SHA-512:	2137AF2CA88AF63103F0D141E5D93F950C2CCE76AE83C96642F5A3C6FBDF1771C97CA7815C79356285466C85B16A7DB3E383E4D87799AAAC3113CBE6FFC67734
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................nw:f........................................

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.494593064233632
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Aqua.x86-20240507-1844.elf
File size:	75'060 bytes
MD5:	7a5c8222fbb9db66a2022383049feb75
SHA1:	37bda45a0588e62524ff9ef5eff0ce7c40f48935
SHA256:	d5735eeba77fd0cb5f71a458528b8b9e0ca6055b9bfc1c5ee457fc3a760320b0
SHA512:	68c3c3fc3727db3a239ff2ded1e8a140972cce08e4741b70e758234d82ed2f50e2afc272ef1ae42960d5b717dedee549199f8f33dbe8e22f1e02f7c1a499604c
SSDEEP:	1536:AhyxFfYHoW8gBss2xIWY9vFEhvUYnCZnlxAr1dXxRJCS6HgYY7:AhyfwHoW8jI/di8qCllxanXEHk7
TLSH:	1D733AC0F653D8F6F86705702137FB374E32E5A5012EDB83EB75A532AC52902EA1669C
File Content Preview:	.ELF....................d...4....#......4. ...(.......................................... ..........d....(..........Q.td............................U..S.......w....h........[]...$.............U......=.....t..5....$......$.......u........t....h............

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74660
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xecd6	0x0	0x6	AX	16
.fini	PROGBITS	0x8056d86	0xed86	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8056da0	0xeda0	0x2c65	0x0	0x2	A	32
.ctors	PROGBITS	0x805a000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805a008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805a020	0x12020	0x344	0x0	0x3	WA	32
.bss	NOBITS	0x805a380	0x12364	0x2560	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x12364	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x11a05	0x11a05	6.5999	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x12000	0x805a000	0x805a000	0x364	0x28e0	4.2551	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 7, 2024 20:45:49.287770033 CEST	33306	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.396903992 CEST	53	33306	8.8.8.8	192.168.2.13
May 7, 2024 20:45:49.397022009 CEST	37756	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.480842113 CEST	53	37756	8.8.8.8	192.168.2.13
May 7, 2024 20:45:49.480917931 CEST	33561	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.565165043 CEST	53	33561	8.8.8.8	192.168.2.13
May 7, 2024 20:45:49.565229893 CEST	58067	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.648962021 CEST	53	58067	8.8.8.8	192.168.2.13
May 7, 2024 20:45:49.649063110 CEST	54351	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.733190060 CEST	53	54351	8.8.8.8	192.168.2.13
May 7, 2024 20:45:49.733304024 CEST	49271	53	192.168.2.13	8.8.8.8
May 7, 2024 20:45:49.817182064 CEST	53	49271	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.252224922 CEST	59192	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.336359024 CEST	53	59192	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.336476088 CEST	36719	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.422522068 CEST	53	36719	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.422619104 CEST	46362	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.506691933 CEST	53	46362	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.506786108 CEST	48356	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.591002941 CEST	53	48356	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.591079950 CEST	54765	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.674977064 CEST	53	54765	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.675060987 CEST	41875	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.758969069 CEST	53	41875	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.759085894 CEST	33375	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.842842102 CEST	53	33375	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.842938900 CEST	50094	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:38.927143097 CEST	53	50094	8.8.8.8	192.168.2.13
May 7, 2024 20:46:38.927227020 CEST	60641	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:39.012120008 CEST	53	60641	8.8.8.8	192.168.2.13
May 7, 2024 20:46:39.012186050 CEST	45849	53	192.168.2.13	8.8.8.8
May 7, 2024 20:46:39.096249104 CEST	53	45849	8.8.8.8	192.168.2.13

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 7, 2024 20:45:58.886003971 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable
May 7, 2024 20:47:18.898376942 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable

Start time (UTC):	18:45:48
Start date (UTC):	07/05/2024
Path:	/tmp/Aqua.x86-20240507-1844.elf
Arguments:	/tmp/Aqua.x86-20240507-1844.elf
File size:	75060 bytes
MD5 hash:	7a5c8222fbb9db66a2022383049feb75

Start time (UTC):	18:45:49
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:51
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:52
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:53
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:54
Start date (UTC):	07/05/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:45:55
Start date (UTC):	07/05/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	18:45:56
Start date (UTC):	07/05/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:45:58
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:57
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:45:59
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:07
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:08
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:09
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.x86-20240507-1844.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/run/systemd/journal/streams/.#9:66606U7U5uf

/run/systemd/journal/streams/.#9:66607OD6MKg

/run/systemd/journal/streams/.#9:66667llEJNg

/run/systemd/journal/streams/.#9:66767B9Xurh

/run/systemd/journal/streams/.#9:66865Fm5LMg

/run/systemd/journal/streams/.#9:67920G084xf

/run/systemd/journal/streams/.#9:67943QknpZd

/run/systemd/journal/streams/.#9:68498VAupeY

/run/systemd/journal/streams/.#9:685723zYLRX

/run/systemd/journal/streams/.#9:68751ZUzcvg

/run/systemd/journal/streams/.#9:68753Pi6kqf

/run/systemd/journal/streams/.#9:687549ul4xd

/run/systemd/journal/streams/.#9:68763WIhRaf

/run/systemd/journal/streams/.#9:68764xOD24c

/run/systemd/journal/streams/.#9:68765qY6e7g

/run/systemd/journal/streams/.#9:68772C744We

/run/systemd/journal/streams/.#9:68773wIpkEf

/run/systemd/journal/streams/.#9:68774pnxXRd

/run/systemd/journal/streams/.#9:68775fOMIwe

/run/systemd/journal/streams/.#9:68783V3Kb9g

/run/systemd/journal/streams/.#9:68785lxcL0c

/run/systemd/journal/streams/.#9:68862ai8Lpd

/run/systemd/journal/streams/.#9:69686kF5PkY

/run/systemd/journal/streams/.#9:69689RafazW

/run/systemd/journal/streams/.#9:69690Log1wX

Linux Analysis Report
Aqua.x86-20240507-1844.elf

Start time (UTC):	18:46:11
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:12
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:18
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:13
Start date (UTC):	07/05/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:46:14
Start date (UTC):	07/05/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:46:15
Start date (UTC):	07/05/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:46:17
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:19
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:20
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:46:21
Start date (UTC):	07/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75