Edit tour

Linux Analysis Report
78O7BJ6Qg2.elf

Overview

General Information

Sample name:	78O7BJ6Qg2.elf renamed because original name is a hash value
Original sample name:	f071aa45759ace7eaa49446f9629e0f5.elf
Analysis ID:	1457961
MD5:	f071aa45759ace7eaa49446f9629e0f5
SHA1:	cf7af720e736b6d66c4e28278dbba2a38931b31a
SHA256:	eeeb3abb1dc4f7439ea12706fd5879ea4e25ee356b6c000eed646b21a18d0d37
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457961
Start date and time:	2024-06-16 10:51:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	78O7BJ6Qg2.elf renamed because original name is a hash value
Original Sample Name:	f071aa45759ace7eaa49446f9629e0f5.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/214@726/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/78O7BJ6Qg2.elf
PID:	5542
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

78O7BJ6Qg2.elf (PID: 5542, Parent: 5456, MD5: f071aa45759ace7eaa49446f9629e0f5) Arguments: /tmp/78O7BJ6Qg2.elf

78O7BJ6Qg2.elf New Fork (PID: 5543, Parent: 5542)

78O7BJ6Qg2.elf New Fork (PID: 5544, Parent: 5543)

gnome-session-binary New Fork (PID: 5547, Parent: 1383)

sh (PID: 5547, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5547, Parent: 1383, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5574, Parent: 1)

dbus-daemon (PID: 5574, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5584, Parent: 1289)

Default (PID: 5584, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5586, Parent: 3147)

fusermount (PID: 5586, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5587, Parent: 2955)

pulseaudio (PID: 5587, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 5588, Parent: 1289)

Default (PID: 5588, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5589, Parent: 1)

dbus-daemon (PID: 5589, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5590, Parent: 1)

rsyslogd (PID: 5590, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5591, Parent: 1289)

Default (PID: 5591, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5599, Parent: 1)

systemd-logind (PID: 5599, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5658, Parent: 1)

agetty (PID: 5658, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5659, Parent: 1)

gpu-manager (PID: 5659, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5660, Parent: 5659)

sh (PID: 5660, Parent: 5659, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5663, Parent: 5660)

grep (PID: 5663, Parent: 5660, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5664, Parent: 5659)

sh (PID: 5664, Parent: 5659, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5665, Parent: 5664)

grep (PID: 5665, Parent: 5664, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5666, Parent: 5659)

sh (PID: 5666, Parent: 5659, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5667, Parent: 5666)

grep (PID: 5667, Parent: 5666, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5668, Parent: 5659)

sh (PID: 5668, Parent: 5659, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5669, Parent: 5668)

grep (PID: 5669, Parent: 5668, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5670, Parent: 5659)

sh (PID: 5670, Parent: 5659, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

systemd New Fork (PID: 5672, Parent: 1)

generate-config (PID: 5672, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5673, Parent: 5672)

pkill (PID: 5673, Parent: 5672, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5674, Parent: 1)

rsyslogd (PID: 5674, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5678, Parent: 1)

journalctl (PID: 5678, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5679, Parent: 1)

systemd-journald (PID: 5679, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5680, Parent: 1)

agetty (PID: 5680, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5683, Parent: 1)

systemd-logind (PID: 5683, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5742, Parent: 1)

systemd-journald (PID: 5742, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5743, Parent: 1)

rsyslogd (PID: 5743, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5744, Parent: 1)

gpu-manager (PID: 5744, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5748, Parent: 5744)

sh (PID: 5748, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5749, Parent: 5748)

grep (PID: 5749, Parent: 5748, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5751, Parent: 5744)

sh (PID: 5751, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5752, Parent: 5751)

grep (PID: 5752, Parent: 5751, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5755, Parent: 5744)

sh (PID: 5755, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5756, Parent: 5755)

grep (PID: 5756, Parent: 5755, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5757, Parent: 5744)

sh (PID: 5757, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5758, Parent: 5757)

grep (PID: 5758, Parent: 5757, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5759, Parent: 5744)

sh (PID: 5759, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5760, Parent: 5759)

grep (PID: 5760, Parent: 5759, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5761, Parent: 5744)

sh (PID: 5761, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5762, Parent: 5761)

grep (PID: 5762, Parent: 5761, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5763, Parent: 5744)

sh (PID: 5763, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5764, Parent: 5763)

grep (PID: 5764, Parent: 5763, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5765, Parent: 5744)

sh (PID: 5765, Parent: 5744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 5750, Parent: 1)

dbus-daemon (PID: 5750, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5766, Parent: 1)

generate-config (PID: 5766, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5767, Parent: 5766)

pkill (PID: 5767, Parent: 5766, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5768, Parent: 1)

rsyslogd (PID: 5768, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5775, Parent: 1)

rsyslogd (PID: 5775, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5778, Parent: 1)

systemd-logind (PID: 5778, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5780, Parent: 1)

systemd-journald (PID: 5780, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5839, Parent: 1)

gpu-manager (PID: 5839, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5842, Parent: 5839)

sh (PID: 5842, Parent: 5839, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5843, Parent: 5842)

grep (PID: 5843, Parent: 5842, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5847, Parent: 5839)

sh (PID: 5847, Parent: 5839, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5848, Parent: 5847)

grep (PID: 5848, Parent: 5847, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5850, Parent: 5839)

sh (PID: 5850, Parent: 5839, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

systemd New Fork (PID: 5840, Parent: 1)

rsyslogd (PID: 5840, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5841, Parent: 1)

dbus-daemon (PID: 5841, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5851, Parent: 1)

generate-config (PID: 5851, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5853, Parent: 5851)

pkill (PID: 5853, Parent: 5851, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5852, Parent: 1)

dbus-daemon (PID: 5852, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5854, Parent: 1)

rsyslogd (PID: 5854, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5858, Parent: 1)

systemd-journald (PID: 5858, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5861, Parent: 1)

systemd-logind (PID: 5861, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5921, Parent: 1)

dbus-daemon (PID: 5921, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5924, Parent: 1)

dbus-daemon (PID: 5924, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5925, Parent: 1)

rsyslogd (PID: 5925, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5926, Parent: 1)

gpu-manager (PID: 5926, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5927, Parent: 5926)

sh (PID: 5927, Parent: 5926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5931, Parent: 5927)

grep (PID: 5931, Parent: 5927, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5932, Parent: 5926)

sh (PID: 5932, Parent: 5926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5934, Parent: 5932)

grep (PID: 5934, Parent: 5932, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5935, Parent: 1)

dbus-daemon (PID: 5935, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5936, Parent: 1)

generate-config (PID: 5936, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5937, Parent: 5936)

pkill (PID: 5937, Parent: 5936, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5938, Parent: 1)

systemd-journald (PID: 5938, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5941, Parent: 1)

systemd-logind (PID: 5941, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6002, Parent: 1)

systemd-logind (PID: 6002, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6061, Parent: 1)

gpu-manager (PID: 6061, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6062, Parent: 6061)

sh (PID: 6062, Parent: 6061, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6063, Parent: 6062)

grep (PID: 6063, Parent: 6062, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6064, Parent: 6061)

sh (PID: 6064, Parent: 6061, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6065, Parent: 6064)

grep (PID: 6065, Parent: 6064, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6066, Parent: 6061)

sh (PID: 6066, Parent: 6061, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6129, Parent: 6066)

grep (PID: 6129, Parent: 6066, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6067, Parent: 1)

systemd-journald (PID: 6067, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6070, Parent: 1)

systemd-logind (PID: 6070, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6130, Parent: 1)

generate-config (PID: 6130, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6131, Parent: 6130)

pkill (PID: 6131, Parent: 6130, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6136, Parent: 1)

systemd-journald (PID: 6136, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6137, Parent: 1)

gpu-manager (PID: 6137, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6138, Parent: 6137)

sh (PID: 6138, Parent: 6137, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6139, Parent: 6138)

grep (PID: 6139, Parent: 6138, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6140, Parent: 6137)

sh (PID: 6140, Parent: 6137, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6141, Parent: 6140)

grep (PID: 6141, Parent: 6140, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6142, Parent: 1)

generate-config (PID: 6142, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6143, Parent: 6142)

pkill (PID: 6143, Parent: 6142, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6144, Parent: 1)

systemd-journald (PID: 6144, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6147, Parent: 1)

gpu-manager (PID: 6147, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6148, Parent: 6147)

sh (PID: 6148, Parent: 6147, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6149, Parent: 6148)

grep (PID: 6149, Parent: 6148, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6150, Parent: 6147)

sh (PID: 6150, Parent: 6147, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6151, Parent: 6150)

grep (PID: 6151, Parent: 6150, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6153, Parent: 6147)

sh (PID: 6153, Parent: 6147, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6154, Parent: 6153)

grep (PID: 6154, Parent: 6153, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6155, Parent: 6147)

sh (PID: 6155, Parent: 6147, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 6152, Parent: 1)

systemd-journald (PID: 6152, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6156, Parent: 1)

generate-config (PID: 6156, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6157, Parent: 6156)

pkill (PID: 6157, Parent: 6156, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6158, Parent: 1)

systemd-journald (PID: 6158, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6159, Parent: 1)

gpu-manager (PID: 6159, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6160, Parent: 6159)

sh (PID: 6160, Parent: 6159, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6161, Parent: 6160)

grep (PID: 6161, Parent: 6160, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6162, Parent: 6159)

sh (PID: 6162, Parent: 6159, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6163, Parent: 6162)

grep (PID: 6163, Parent: 6162, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6165, Parent: 6159)

sh (PID: 6165, Parent: 6159, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6166, Parent: 6165)

grep (PID: 6166, Parent: 6165, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6164, Parent: 1)

systemd-journald (PID: 6164, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6167, Parent: 1)

generate-config (PID: 6167, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6170, Parent: 6167)

pkill (PID: 6170, Parent: 6167, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6171, Parent: 1)

systemd-journald (PID: 6171, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6172, Parent: 1)

gpu-manager (PID: 6172, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6173, Parent: 6172)

sh (PID: 6173, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6174, Parent: 6173)

grep (PID: 6174, Parent: 6173, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6175, Parent: 6172)

sh (PID: 6175, Parent: 6172, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6176, Parent: 6175)

grep (PID: 6176, Parent: 6175, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6177, Parent: 1)

generate-config (PID: 6177, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6178, Parent: 6177)

pkill (PID: 6178, Parent: 6177, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6181, Parent: 1)

gdm-wait-for-drm (PID: 6181, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6186, Parent: 1)

gdm3 (PID: 6186, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6190, Parent: 6186)

plymouth (PID: 6190, Parent: 6186, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6264, Parent: 6186)

gdm-session-worker (PID: 6264, Parent: 6186, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6270, Parent: 6264)

gdm-wayland-session (PID: 6270, Parent: 6264, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6274, Parent: 6270)

dbus-run-session (PID: 6274, Parent: 6270, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6275, Parent: 6274)

dbus-daemon (PID: 6275, Parent: 6274, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6279, Parent: 6275)

dbus-daemon New Fork (PID: 6280, Parent: 6279)

false (PID: 6280, Parent: 6279, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6282, Parent: 6275)

dbus-daemon New Fork (PID: 6283, Parent: 6282)

false (PID: 6283, Parent: 6282, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6284, Parent: 6275)

dbus-daemon New Fork (PID: 6285, Parent: 6284)

false (PID: 6285, Parent: 6284, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6286, Parent: 6275)

dbus-daemon New Fork (PID: 6287, Parent: 6286)

false (PID: 6287, Parent: 6286, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6288, Parent: 6275)

dbus-daemon New Fork (PID: 6289, Parent: 6288)

false (PID: 6289, Parent: 6288, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6290, Parent: 6275)

dbus-daemon New Fork (PID: 6291, Parent: 6290)

false (PID: 6291, Parent: 6290, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6293, Parent: 6275)

dbus-daemon New Fork (PID: 6294, Parent: 6293)

false (PID: 6294, Parent: 6293, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6276, Parent: 6274)

gnome-session (PID: 6276, Parent: 6274, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6276, Parent: 6274, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6295, Parent: 6276)

session-migration (PID: 6295, Parent: 6276, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6296, Parent: 6276)

sh (PID: 6296, Parent: 6276, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6296, Parent: 6276, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 6304, Parent: 6186)

gdm-session-worker (PID: 6304, Parent: 6186, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6309, Parent: 6304)

gdm-x-session (PID: 6309, Parent: 6304, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 6311, Parent: 6309)

Xorg (PID: 6311, Parent: 6309, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 6311, Parent: 6309, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 6311, Parent: 6309, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 6320, Parent: 6311)

sh (PID: 6320, Parent: 6311, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6321, Parent: 6320)

xkbcomp (PID: 6321, Parent: 6320, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6555, Parent: 6311)

sh (PID: 6555, Parent: 6311, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6557, Parent: 6555)

xkbcomp (PID: 6557, Parent: 6555, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 6326, Parent: 6309)

Default (PID: 6326, Parent: 6309, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 6327, Parent: 6309)

dbus-run-session (PID: 6327, Parent: 6309, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6328, Parent: 6327)

dbus-daemon (PID: 6328, Parent: 6327, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 6343, Parent: 6328)

dbus-daemon New Fork (PID: 6344, Parent: 6343)

at-spi-bus-launcher (PID: 6344, Parent: 6343, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 6349, Parent: 6344)

dbus-daemon (PID: 6349, Parent: 6344, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6719, Parent: 6349)

dbus-daemon New Fork (PID: 6720, Parent: 6719)

at-spi2-registryd (PID: 6720, Parent: 6719, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 6370, Parent: 6328)

dbus-daemon New Fork (PID: 6371, Parent: 6370)

false (PID: 6371, Parent: 6370, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6373, Parent: 6328)

dbus-daemon New Fork (PID: 6374, Parent: 6373)

false (PID: 6374, Parent: 6373, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6375, Parent: 6328)

dbus-daemon New Fork (PID: 6376, Parent: 6375)

false (PID: 6376, Parent: 6375, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6377, Parent: 6328)

dbus-daemon New Fork (PID: 6378, Parent: 6377)

false (PID: 6378, Parent: 6377, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6379, Parent: 6328)

dbus-daemon New Fork (PID: 6380, Parent: 6379)

false (PID: 6380, Parent: 6379, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6381, Parent: 6328)

dbus-daemon New Fork (PID: 6382, Parent: 6381)

false (PID: 6382, Parent: 6381, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6384, Parent: 6328)

dbus-daemon New Fork (PID: 6385, Parent: 6384)

false (PID: 6385, Parent: 6384, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6558, Parent: 6328)

dbus-daemon New Fork (PID: 6559, Parent: 6558)

ibus-portal (PID: 6559, Parent: 6558, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6735, Parent: 6328)

dbus-daemon New Fork (PID: 6736, Parent: 6735)

gjs (PID: 6736, Parent: 6735, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6929, Parent: 6328)

dbus-daemon New Fork (PID: 6930, Parent: 6929)

false (PID: 6930, Parent: 6929, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 6329, Parent: 6327)

gnome-session (PID: 6329, Parent: 6327, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 6329, Parent: 6327, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 6330, Parent: 6329)

gnome-session-check-accelerated (PID: 6330, Parent: 6329, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 6350, Parent: 6330)

gnome-session-check-accelerated-gl-helper (PID: 6350, Parent: 6330, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 6359, Parent: 6330)

gnome-session-check-accelerated-gles-helper (PID: 6359, Parent: 6330, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 6386, Parent: 6329)

session-migration (PID: 6386, Parent: 6329, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 6387, Parent: 6329)

sh (PID: 6387, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 6387, Parent: 6329, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6480, Parent: 6387)

ibus-daemon (PID: 6480, Parent: 6387, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6552, Parent: 6480)

ibus-memconf (PID: 6552, Parent: 6480, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6553, Parent: 6480)

ibus-daemon New Fork (PID: 6554, Parent: 6553)

ibus-x11 (PID: 6554, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6774, Parent: 6480)

ibus-engine-simple (PID: 6774, Parent: 6480, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6749, Parent: 6329)

sh (PID: 6749, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6749, Parent: 6329, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6751, Parent: 6329)

sh (PID: 6751, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6751, Parent: 6329, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6754, Parent: 6329)

sh (PID: 6754, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6754, Parent: 6329, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6755, Parent: 6329)

sh (PID: 6755, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6755, Parent: 6329, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6758, Parent: 6329)

sh (PID: 6758, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6758, Parent: 6329, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6931, Parent: 6758)

gsd-print-notifications New Fork (PID: 6932, Parent: 6931)

gsd-printer (PID: 6932, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6759, Parent: 6329)

sh (PID: 6759, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6759, Parent: 6329, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6762, Parent: 6329)

sh (PID: 6762, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6762, Parent: 6329, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6763, Parent: 6329)

sh (PID: 6763, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6763, Parent: 6329, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6764, Parent: 6329)

sh (PID: 6764, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6764, Parent: 6329, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6766, Parent: 6329)

sh (PID: 6766, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6766, Parent: 6329, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6769, Parent: 6329)

sh (PID: 6769, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6769, Parent: 6329, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6773, Parent: 6329)

sh (PID: 6773, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6773, Parent: 6329, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6777, Parent: 6329)

sh (PID: 6777, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6777, Parent: 6329, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6781, Parent: 6329)

sh (PID: 6781, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6781, Parent: 6329, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 7285, Parent: 6329)

sh (PID: 7285, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 7285, Parent: 6329, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 7287, Parent: 6329)

sh (PID: 7287, Parent: 6329, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

gdm3 New Fork (PID: 6305, Parent: 6186)

Default (PID: 6305, Parent: 6186, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6306, Parent: 6186)

Default (PID: 6306, Parent: 6186, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6188, Parent: 1)

dbus-daemon (PID: 6188, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6191, Parent: 1)

systemd-logind (PID: 6191, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6250, Parent: 1)

agetty (PID: 6250, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6251, Parent: 1)

accounts-daemon (PID: 6251, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6255, Parent: 6251)

language-validate (PID: 6255, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6256, Parent: 6255)

language-options (PID: 6256, Parent: 6255, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6257, Parent: 6256)

sh (PID: 6257, Parent: 6256, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6258, Parent: 6257)

locale (PID: 6258, Parent: 6257, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6259, Parent: 6257)

grep (PID: 6259, Parent: 6257, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6260, Parent: 1)

polkitd (PID: 6260, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6272, Parent: 1299)

dbus-daemon (PID: 6272, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6393, Parent: 2955)

dbus-daemon (PID: 6393, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6394, Parent: 2955)

pulseaudio (PID: 6394, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6397, Parent: 1)

rtkit-daemon (PID: 6397, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6418, Parent: 1)

systemd-localed (PID: 6418, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6567, Parent: 1)

upowerd (PID: 6567, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6607, Parent: 1299)

pulseaudio (PID: 6607, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6612, Parent: 1)

geoclue (PID: 6612, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6726, Parent: 1)

wpa_supplicant (PID: 6726, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6729, Parent: 1)

avahi-daemon (PID: 6729, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6730, Parent: 6729)

systemd New Fork (PID: 6731, Parent: 1)

packagekitd (PID: 6731, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6753, Parent: 6731)

dpkg (PID: 6753, Parent: 6731, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6797, Parent: 1)

systemd-hostnamed (PID: 6797, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6973, Parent: 1)

fprintd (PID: 6973, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 7086, Parent: 1)

colord (PID: 7086, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

systemd New Fork (PID: 7091, Parent: 1)

systemd-localed (PID: 7091, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 7223, Parent: 1)

ModemManager (PID: 7223, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
78O7BJ6Qg2.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
78O7BJ6Qg2.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
78O7BJ6Qg2.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17d04:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x8eb0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f1:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1140:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1220:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f5:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a0:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a33:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf88d:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xbff2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x2292:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12aec:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x1110f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
78O7BJ6Qg2.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xbfc2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5542.1.0000000008048000.0000000008063000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x184a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1852c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1857c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1861c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17d04:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x8eb0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f1:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1140:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1220:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f5:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a0:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a33:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xf88d:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xbff2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x2292:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12aec:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x1110f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5542.1.0000000008048000.0000000008063000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xbfc2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: 78O7BJ6Qg2.elf PID: 5542	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: 78O7BJ6Qg2.elf PID: 5542	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xada:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 78O7BJ6Qg2.elf PID: 5542	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6df:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 13 entries

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbash/fd/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.kovey-net.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.14:40406 -> 45.131.111.98:1312
Source: global traffic	TCP traffic: 192.168.2.14:57256 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5590)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5674)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5743)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5768)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5775)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5840)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5854)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5925)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5742)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5780)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5858)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5938)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6067)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6136)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6144)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6152)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6158)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6164)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6186)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6275)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6276)	Socket: unknown address family
Source: /usr/lib/xorg/Xorg (PID: 6311)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6328)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6349)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 6329)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 6480)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.kovey-net.ru
Source: global traffic	DNS traffic detected: DNS query: raw.kovey-net.ru. [malformed]

Source: Xorg.0.log.354.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.354.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.31.dr, syslog.63.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5547, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5528, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5574, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5586, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5587, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5590, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5658, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5553, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5599, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5672, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5679, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5744, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5680, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5766, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5768, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5742, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5774, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5775, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5819, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5819, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5778, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5780, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5921, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5920, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5920, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5926, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5861, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5933, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5935, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5936, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5938, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6002, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6130, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6137, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6136, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6142, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6143, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6147, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6156, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6152, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6159, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6164, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6172, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6176, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6343, result: successful
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6558, result: successful
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6735, result: successful
Source: /usr/bin/dbus-daemon (PID: 6349)	SIGKILL sent: pid: 6719, result: successful

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5547, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5528, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5574, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5586, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5587, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5590, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5658, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5373, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5553, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5599, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5671, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5672, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5679, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5743, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5744, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5680, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5766, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5768, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5742, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5774, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5775, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5819, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5819, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5839, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5840, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5841, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5778, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5780, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5849, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5852, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5854, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5921, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5920, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5920, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5925, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5926, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5858, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5861, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5933, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5935, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5936, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 5938, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6002, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6130, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6137, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6136, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6142, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6143, result: no such process	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6147, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6156, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6152, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6159, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6164, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6172, result: successful	Jump to behavior
Source: /tmp/78O7BJ6Qg2.elf (PID: 5544)	SIGKILL sent: pid: 6176, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6343, result: successful
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6558, result: successful
Source: /usr/bin/dbus-daemon (PID: 6328)	SIGKILL sent: pid: 6735, result: successful
Source: /usr/bin/dbus-daemon (PID: 6349)	SIGKILL sent: pid: 6719, result: successful

Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 78O7BJ6Qg2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/214@726/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5589)	File: /proc/5589/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5750)	File: /proc/5750/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5841)	File: /proc/5841/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5921)	File: /proc/5921/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5924)	File: /proc/5924/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5935)	File: /proc/5935/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6275)	File: /proc/6275/mounts
Source: /usr/bin/dbus-daemon (PID: 6328)	File: /proc/6328/mounts
Source: /usr/bin/dbus-daemon (PID: 6349)	File: /proc/6349/mounts
Source: /usr/bin/gjs (PID: 6736)	File: /proc/6736/mounts
Source: /usr/bin/gnome-shell (PID: 6387)	File: /proc/6387/mounts
Source: /usr/bin/dbus-daemon (PID: 6188)	File: /proc/6188/mounts
Source: /usr/bin/dbus-daemon (PID: 6272)	File: /proc/6272/mounts
Source: /usr/bin/dbus-daemon (PID: 6393)	File: /proc/6393/mounts

Source: /lib/systemd/systemd-logind (PID: 5599)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5599)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5599)	File: /run/systemd/seats/.#seat0OCqCVx	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5683)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5683)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5683)	File: /run/systemd/seats/.#seat0C0yMeV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5778)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5778)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5861)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5861)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:733479xYPtO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73351U4yFUP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:733521eC1wO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73353FFQYPO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73354PhWYzO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:733552yO3BN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73356NsgYGP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73357siueeQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73358UJzYHQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73359moftGP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73360KZ3TAN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73361lJPqkN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73362BS7IxO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73363J43sjR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73364VtewkQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:733656jKpTM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73366TyXa6M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73367FSOqjO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73368xe3MxQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:733699tCqzO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73370ezglTO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73371TXR47Q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73372ksl4GQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:734698k2dkR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73470zKkLqO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73503esAMaO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73514D5uOSP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73515rxDCUP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73520DzzxiO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73561V1WF5O	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73562T9KTNO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73575UEcuHO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73576dh7brP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:7362008SbwN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:73657mO1qhO	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 6296)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6296)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 6311)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 6311)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6330)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6330)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6330)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6350)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6359)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6359)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6359)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 6387)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6554)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6554)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6751)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6751)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6754)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6754)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6755)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6755)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6759)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6759)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6781)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6781)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0Cd6YKm
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127E7HOSl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#1274boXnk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1T09tXl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127pB1hHl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0RAc34j
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127wqq3Mj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1C9o9ql
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1ptiNKl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127Yxxhvk
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0ilwM0j
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1wIBXAi
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127G34iml
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1CXir0k
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1RSM9dm
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c1mcI7tk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127OmhCik
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (20)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0Qyx7Gk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127Z8cAyj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0RRnGgj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127kTgVQj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0adRrtk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127pKSV3j
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c2Y7Vklm
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#1273bKWwj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/seats/.#seat0xPk9tl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c21PWCRm
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c2rMWy7l
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/users/.#127iEtCWj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c2mCrwXl
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c287JqWj
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (21)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c214ovRl
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (22)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c2BmQHVl
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (24)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/sessions/.#c2SYjnHk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/inhibit/.#1p7XkJj
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/inhibit/.#25IS4Mk
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/inhibit/.#32oOf7m
Source: /lib/systemd/systemd-logind (PID: 6191)	File: /run/systemd/inhibit/.#4XnDTwj
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6251)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6251)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6260)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6567)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6567)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6731)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6797)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 7086)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 7223)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 7223)	Directory: <invalid fd (11)>/..

Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3760/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3761/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/247/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/7/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/7/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/249/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/249/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/8/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	File opened: /proc/8/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5660)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5664)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5666)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5668)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5670)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5748)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5751)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5755)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5757)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5759)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5761)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5763)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5765)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5842)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5847)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5850)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5927)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5932)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6062)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6064)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6066)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6138)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6140)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6148)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6150)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6153)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6155)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6160)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6162)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6165)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6173)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6175)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6320)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6555)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 6257)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5663)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5665)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5667)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5669)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5749)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5752)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5756)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5758)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5760)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5762)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5764)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5843)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5848)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5931)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5934)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6063)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6065)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6129)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6139)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6141)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6149)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6151)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6154)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6161)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6163)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6166)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6174)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6176)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6259)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5673)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5767)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5853)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5937)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6131)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6143)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6157)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6170)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6178)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5742)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5780)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5858)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5938)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6067)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6136)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6144)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6152)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6158)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6164)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /sbin/agetty (PID: 5658)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5680)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6250)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6186)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6186)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6251)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6251)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5590)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5590)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5674)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5743)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5768)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5840)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5854)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5925)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 6311)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/78O7BJ6Qg2.elf (PID: 5543)

File: /tmp/78O7BJ6Qg2.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5659)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5744)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5839)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5926)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6061)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6137)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6147)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6159)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6172)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6311)	Truncated file: /var/log/Xorg.pid-6311.log

Source: /usr/bin/pkill (PID: 5673)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5767)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5853)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6131)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6157)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6170)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6178)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6311)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6330)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6350)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6359)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 6387)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6394)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6607)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/sbin/rsyslogd (PID: 5590)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5658)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5674)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5680)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5742)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5743)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5744)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5768)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5775)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5780)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5840)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5854)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5858)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5925)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5938)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6067)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6136)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6144)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6152)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6158)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6164)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6171)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6264)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 6276)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6304)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 6309)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 6311)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 6344)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6720)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 6329)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 6330)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 6350)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 6359)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 6387)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6554)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6751)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6754)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6755)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6762)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6764)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6781)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6250)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6394)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6607)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6729)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6731)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6797)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6973)	Queries kernel information via 'uname':

Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.745] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.081] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.246] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.054] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.292] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.951] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.122] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.548] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.744] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 208.992] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.670] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.857] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.456] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.333] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.288] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.727] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.629] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.089] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.031] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.702] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.749] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.821] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.084] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.224] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.176] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.752] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.788] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.614] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.639] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.711] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.783] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.367] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.415] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.275] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.758] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.130] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.129] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.637] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.723] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.525] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.966] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.659] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.506] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.625] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.966] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.816] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.990] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.344] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.717] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.282] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.255] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.776] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.570] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.633] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.297] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.379] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.969] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.585] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.102] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.910] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.557] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.710] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.162] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.047] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.701] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.525] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.853] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.665] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.106] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.652] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.334] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.386] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.800] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.953] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.645] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.807] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.959] (--) vmware(0): vis: 4
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.320] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.633] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.465] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.069] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.235] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.616] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.973] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.032] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.939] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.601] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.982] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.553] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.581] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.829] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.841] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.580] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.390] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.671] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.931] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.983] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.811] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.807] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.768] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.241] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.845] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.694] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.075] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.996] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.31.dr	Binary or memory string: Jun 16 03:52:36 galassia /usr/lib/gdm3/gdm-x-session[2999]: (II) vmware(0): Terminating Xv video-stream id:0
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.600] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.527] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.005] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.772] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.784] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.914] (--) vmware(0): bpp: 32
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.754] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.169] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.824] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.735] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.539] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.661] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.919] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.759] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.722] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 208.904] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.569] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.686] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.557] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.935] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.706] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.435] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.557] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.871] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.042] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.463] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.653] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.060] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.292] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.144] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.657] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.037] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.384] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.879] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.338] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.906] (--) vmware(0): depth: 24
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.479] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.927] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.247] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.039] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.875] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.690] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.076] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.049] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.539] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.978] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.065] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.577] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.158] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.087] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.017] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.312] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.594] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.472] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.763] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.485] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.906] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.896] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.261] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.792] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.326] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.374] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.698] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.544] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.676] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.729] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.099] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.771] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.564] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.943] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.678] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 208.887] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.944] (--) vmware(0): w.red: 8
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.963] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.665] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.928] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.861] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.172] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.738] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.230] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.765] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.780] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.448] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.955] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.073] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.495] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.916] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.449] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.301] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.395] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.409] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.739] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.355] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.923] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.358] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.641] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.091] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.625] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.076] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.895] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.804] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.803] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.229] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.329] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.420] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.646] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.220] (II) LoadModule: "vmware"
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.110] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.457] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.883] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.947] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.151] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.332] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.891] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.565] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 208.850] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.061] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.608] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.332] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.288] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.400] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.674] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.301] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.825] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.869] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.133] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.547] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.605] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.682] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.215] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.587] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.790] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.987] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.597] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.325] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.498] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.903] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.589] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.841] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.867] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.959] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.833] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.949] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.649] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.532] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.927] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 205.166] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.185] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.509] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.887] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.222] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.936] (--) vmware(0): depth: 24
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.470] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.923] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.837] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.621] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.099] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.531] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.019] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.448] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.899] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.352] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.011] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.849] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.561] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.997] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.731] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.573] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.796] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.940] (--) vmware(0): bpp: 32
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.486] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.502] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.479] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.069] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.186] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.022] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.975] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.070] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.055] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.531] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.360] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.001] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.518] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.931] (--) vmware(0): mheig: 885
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.426] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.268] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.294] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.830] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.898] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.092] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.274] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.551] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.491] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 209.106] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.689] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.312] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.442] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.026] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.798] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.991] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.593] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 202.553] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.537] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 199.182] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.354.dr	Binary or memory string: [ 203.776] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.354.dr	Binary or memory string: [ 204.282] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6251)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 78O7BJ6Qg2.elf, type: SAMPLE
Source: Yara match	File source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 78O7BJ6Qg2.elf, type: SAMPLE
Source: Yara match	File source: 5542.1.0000000008048000.0000000008063000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 78O7BJ6Qg2.elf PID: 5542, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
78O7BJ6Qg2.elf	61%	ReversingLabs	Linux.Trojan.Mirai
78O7BJ6Qg2.elf	43%	Virustotal		Browse
78O7BJ6Qg2.elf	100%	Avira	EXP/ELF.Mirai.Z.A
78O7BJ6Qg2.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
raw.kovey-net.ru	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://wiki.x.org	0%	Avira URL Cloud	safe
http://www.ubuntu.com/support)	0%	Avira URL Cloud	safe
https://www.rsyslog.com	0%	Avira URL Cloud	safe
https://www.rsyslog.com	0%	Virustotal		Browse
http://www.ubuntu.com/support)	0%	Virustotal		Browse
http://wiki.x.org	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.kovey-net.ru	45.131.111.98	true	true	4%, Virustotal, Browse	unknown
raw.kovey-net.ru. [malformed]	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.31.dr, syslog.63.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wiki.x.org	Xorg.0.log.354.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ubuntu.com/support)	Xorg.0.log.354.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.131.111.98	raw.kovey-net.ru	Germany		398373	SERVERDESTROYERSUS	true
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.131.111.98	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	ow3g8oByWQ.elf	Get hash	malicious	Mirai, Okiru	Browse
	VsCvpuEOwx.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	Ir9ftOWi9N.elf	Get hash	malicious	Mirai	Browse
	1YdIQ44qI2.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	1XNbQG2Avw.elf	Get hash	malicious	Mirai	Browse
	SDJWHJEpXJ.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse
	yM7oPd5Yxq.elf	Get hash	malicious	Unknown	Browse
	HLmuJO331U.elf	Get hash	malicious	Unknown	Browse
	7qOP4QJI3C.elf	Get hash	malicious	Unknown	Browse
	lCNMdusFkn.elf	Get hash	malicious	Unknown	Browse
	pU1kwVc58Q.elf	Get hash	malicious	Unknown	Browse
	xGt89YgAK2.elf	Get hash	malicious	Unknown	Browse
	hTbM6ZMlFa.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.kovey-net.ru	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
raw.kovey-net.ru	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	yM7oPd5Yxq.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	HLmuJO331U.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	7qOP4QJI3C.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	lCNMdusFkn.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	pU1kwVc58Q.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	xGt89YgAK2.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	hTbM6ZMlFa.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
SERVERDESTROYERSUS	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	ow3g8oByWQ.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	VsCvpuEOwx.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	Ir9ftOWi9N.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	1YdIQ44qI2.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	1XNbQG2Avw.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	SDJWHJEpXJ.elf	Get hash	malicious	Mirai	Browse	45.131.111.98

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6280/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6283/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6285/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6287/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6289/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6291/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6294/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6344/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6371/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6374/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6376/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6378/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6380/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6382/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6385/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6559/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6720/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6736/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6930/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Icvn:Icv
MD5:	A400A09BB406DE5569E36577EC623579
SHA1:	ED1FED7EE7F1F9E2E636AFFF66021D6445E35C0A
SHA-256:	3067BCDF80D831112D6FCC16A10FBC6074D17EDDAB46F9E6321C4AE493B61546
SHA-512:	7A2667EF2E93BF419C4CEFD2739872D5BE7CF084390A3DC48599CEFEA60F661ABEC00BC463BA3863E3B69F62FBD4E59FAD5142D085B8BE4C73A606292DBB0403
Malicious:	false
Preview:	6729.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:wTvn:wjn
MD5:	8E67C202C89D11E3877CCE9BA12CB305
SHA1:	BCEE37FEEFC0376D284954CA7B04652AA2913301
SHA-256:	8F36CFF365FF3400F63E20317F33D9A644CAD352FDFF526BA968EEF6782CA6BA
SHA-512:	654E78F5AE9293D3457893D03F3558D0356FC882BE0EFFAC2E679ECA0A0BC79512FC18E47CD15CFA0EBF1305ADE41FA2AA25640DB333DFCBF7281933979603F8
Malicious:	false
Preview:	6186.

/run/systemd/inhibit/.#1p7XkJj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifc1AIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfceApLHK7wR9n
MD5:	42D8E8CA1310002A8668DE82B6AF8663
SHA1:	6250A86B8C1FE5E6BBB1E1FEFCD0AB3DEF3B8158
SHA-256:	62B75CEE7D673546EF674483D14590F92C7CFAE778E2BE572ED87BAF53D3B1D5
SHA-512:	5FE997B218EE42C7C8B642105D57FB8E6DCE7FCFA68F6E4B04D01B4DC8229B8416FAB8F64CB40D44A4D7B65CFC07AF589D9866771962689F58E84812A4E93CDA
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6567.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#25IS4Mk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.209300645304899
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+KgqKLXv0Rsz:qgFqXQXTI1IlyqKjcRsz
MD5:	BE26218A7F61F65248ACC349ACA0280C
SHA1:	41A64D7A32BCCD53892157BB631E04D00F300BC1
SHA-256:	E5AF05B4B92365B0A0D8CA84C528F0AED0A74710D0D2FA8D10FB2C9D7F336CD7
SHA-512:	2D8C91192D8ECA82DE1EA06BFEB0DF690CFA86588EDD1AA19066F5B2B4C8C6BA39A80C40DFFF28683C52A2B58B9C1A19BD7A7DEBD771749142ED48E1A0CC8EAF
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6764.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#32oOf7m

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++2+jC3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+KgqKLXv0RT
MD5:	5435B3DC23575904A01B910B8FE6E3B4
SHA1:	DEF342CB64A5A5F36A2DE2245363244E93042092
SHA-256:	8123D9F8A0E6F6E8F8F9CD7BB81141E517819BF9391135688C5E36BCB547E500
SHA-512:	089B76EBCEC7D50F6D03487E9A0D23DF9D59015453116194FA1D012BFB11B0A8C762C5E82F711BB5915F2A71625111EB71762450D961A14881C22419F74ED3B6
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6764.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4XnDTwj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++GiiXulpv5RX8/SflY:SbFuFyL8OAAx+90lpLRS
MD5:	0BD85BF9979AAF0B1B75934490B1CFC1
SHA1:	781D7FEAFCC5A0EED9955874F15B4A7093C50B19
SHA-256:	FC113FE8A1AE57A34325DBA09B95C3743CE6C512290FE3DD004F10FCB01F3BC8
SHA-512:	BC7464890953A97991EFDE165BB9EBEF60CB86C812F4E299E42001478D822AA210374ABF361EBD7486FCC8F9DC2B023EF4B896FF3D42AE613A250A2449B7944B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6781.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/journal/streams/.#9:733479xYPtO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.55031841131392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6nXGMzoF2js7Lbgw3:SbFuFyLVIg1BG+f+M6Lo8ji4s
MD5:	F356058EED06270BC0FF3B54649A063F
SHA1:	2704CE1AD6C1E2A5E6111A5E45400F451735423F
SHA-256:	CDBAC5F6C24B73DB395F62D834A51F5DF8143EDA924D712B0740628CC7901353
SHA-512:	74A826BE3C15BDA6B9E6F3A938E38FE2800DE7582D55B7EAA3F3BDAE280363323E2BFB905F90D9A79B91E80FBA07E71A2C39C0FEA53E5F4AF9542167436EC280
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0826479b572c453ab75c1d31c9fde3cd.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:73351U4yFUP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.485305806195746
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ebHQSTuxsjsicWmt:SbFuFyLVIg1BG+f+MqHTTjZcHcljX+
MD5:	DDB94713900D6D3DD0AF633E2BB0C224
SHA1:	AFB8F7BF148666B40169F9AAF426826DF347BE0D
SHA-256:	B6EA67A022C457EF426FBFE47EEFC345B58756A4C2143B5FCCEF047774BBC6D2
SHA-512:	350491F6B911BAC9543E7DFFEE4D8B29FA5EFA1CC3B48DA4D8254CA65BFFBA07152FDAD6E049B4D5303C98AE60448BB3C6D0236E1874ABAD67F82AA70C51E138
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=777fe906e40f423ca5fb2fd990570830.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:733521eC1wO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421526266515029
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+EQZWcRRccEDujs16:SbFuFyLVIg1BG+f+M+EQ2MjosQu
MD5:	4494AB46B8995968549217B9E3CBEF8E
SHA1:	E4831C4C6517254F3C769F53DAB89130A30B5491
SHA-256:	03EA33AF93E6C49D219E3DC1759A4A9FC4F1AAA611236F4CD4C95F51F6D109A4
SHA-512:	36933184C15CA04C3181EAD998A6C0E2112C2207355FB0A1B4D5531EDD66B30FD28186CB1F0A87DA6D85407C44D30CEB084A5D8CE153A714E22C321A9356573A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a5fc5c048e74e839334c77799a80699.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73353FFQYPO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.444453696692833
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6U0dWdQR0QvAg2js2Ax:SbFuFyLVIg1BAf+M6U9mxF2jNALyAZD
MD5:	81330DA475D74BC5E78B3A828512B322
SHA1:	AA037137B06E1B0B74A01F48164A5AA125642983
SHA-256:	6212B07F9607E090C3CDB72853DB4F4E305978AD73D5F8469BEEA0E42EF3E121
SHA-512:	92582F8E5CE569354A6EB4A307FDEB35B4116B15CAA98FF08B613072040C7C6C4CD0C17361C3393DF3648B3480D2ABD6656B45F00A60C408F70C65FFA3203CED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=05d529e3e8394e2286748f5f1464ef87.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73354PhWYzO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.374249900746656
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpKNzDXEAf/1vTjswK:SbFuFyLVIg1BG+f+MYNzDXpf/hTjLkGq
MD5:	F8BFF6DC30369A9141CEAA74C461E910
SHA1:	EC427BE044247198ABF60A7FD809101593D50EE4
SHA-256:	CD10318E508AEBCBE067260C9CDEE9D8D5BD2C6EF975B27A361B315AF7A3084B
SHA-512:	A67EA307204587C9D89826475985E3DBD984820F373CB32EBBB0AA90D3E71B2E8B2A297BF21FE721FE3AAA59BC2AD8CD06D888E1EC0A195FFBF70B90AF7E7AC2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3a359f08ff4433daed93088007cfb38.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:733552yO3BN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.496729954295644
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+NzCcjiZjsicWmI2d:SbFuFyLVIg1BG+f+M+NzGZjZcHcljX+
MD5:	8C58A9903971C6444816000C63DAB245
SHA1:	108A23E1DA63B35C019C9C7C84BAE20B21B538DE
SHA-256:	9CEDE040A99141E16B3C5A02E068B677D6DFBA1B9A1240246F9958D52752F1A3
SHA-512:	1876D51BC88D7B669C307889FFB6E110BAB091B229EDC9D6226164A8EEF7F6BCD2E171F3EFD91401A8B1C18BD75CAC003803EAC5F4C6E90B36C746263DA3412E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=413cfc477884406d8e6894b32a293c14.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73356NsgYGP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.424109903898111
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ZNUXEASaTzrxsjsc:SbFuFyLVIg1BG+f+MqTzrqjosQu
MD5:	17F66AEB08100BA378F926E10E78EF8C
SHA1:	30143EB980E8BB1E5EFF45F3CB2B6A83303B9850
SHA-256:	ED584B7DB6FF35D0016D0997A4459768B9CCC8A0EEAFC260EB0353D7E89F32C7
SHA-512:	86A3F67F72C87BAB57353E0B5F94011BF6F5B7650A5E5E1CC1DE9BAF7F430E148686EDC2CF93E877C1D9F2053944567487920898A90CDF2951AA8326A6F3C4DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7609128329e647fea73fc623ec31de91.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73357siueeQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.411516158271994
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvFLG7HcFrxsjs2ALAXA:SbFuFyLVIg1BAf+MsaqjNALyAZD
MD5:	C12C1C70912E8BA4810BD4D2F4EE4149
SHA1:	B5D5A8E6135A9A73F3A84291EFB9348FB0873CC4
SHA-256:	8D9312C6AD5ECCB052B02A791128AA8590415D622AD665DDAFD1B7FC94EA8955
SHA-512:	CA6AF0D662E628552794246928A4BC3F02C57CF85D3BAE130BC727A9F2C4ED41F886F652F2ED9EE2620DAA30EA4F792107748D0F874F342C147F857D34068DAD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e031085370ba4f6a91021a983bbadfa3.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73358UJzYHQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.410180780787508
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmouUEBz9EPW7hgrxsd:SbFuFyLVIg1BG+f+MouUoz5hgrqjosQu
MD5:	2A036DFFD4150BF85EE1136241A0277D
SHA1:	8DB9EE831DD58A1004C52839A3A61461D5CB9970
SHA-256:	E080E89FDEE1148E98ECC9C41AA8F7216913E1720377884B77ECFE178EB9287E
SHA-512:	D76AAEFA2B323EE126828A730DF04E38E4D61DD3381F79FDE18811F1832F9DFB7EE5D969BBC57672A9DE464E49008BCB224E0BB02A31A8AA5DB2DDE2543A9350
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2e8201e5f674d08ba07cc0a67a6f38c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73359moftGP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.435585620140263
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MywXyILV1jZcHcljX+:qgFq6g10+f+MlyILV3mAu
MD5:	1BF35240EA7B16F0E73555EF00B8A6E5
SHA1:	910055A8451F598E28979BAE8BF390DA4831CC5B
SHA-256:	EA27EBFD4E73591A939208F5E06F4FC72FC51444BEC559C0279242485D2AA8E6
SHA-512:	88D388043763795F12CF1263D68B68E9397004BB258239443ABE1E127F6749B15E4CAEDEC99A868AF4E44082D35BEF0E8D227E71A7AAAF2C6C844AAE2A4513ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8dc34140a3594ea1bad0a414f4750da2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73360KZ3TAN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425186321900641
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrjI6yjEBMqjs1Had9:SbFuFyLVIg1BG+f+MvIvjxqjosQu
MD5:	79B5A84A049B31AA7F5C56A038CA8C72
SHA1:	61BDEEB878D95B5B76C6FDB4F6689A668DCF989F
SHA-256:	40B604D24A9AB88B5805D7386EB71B01E55E1F74022640B6CE8399EE377D2A2C
SHA-512:	75F5050EF6D929789EED05F38FF2DC11081D0618851B92290B636F0F89AE770625BD7F9AC3BA5D940AECE06EFB871F69D9165963F18B141C8C8EE6128272EFA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa03fc4705f24101929d89a6fa118cce.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73361lJPqkN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4257802980185845
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmywPgUmER1z22js1Ha:SbFuFyLVIg1BG+f+MywBW2josQu
MD5:	7FB257F121546FB1A013AF4096E174BF
SHA1:	F0D7A45E882F393BB49515E9D051676FD461B881
SHA-256:	4D7954EC984FC810E0152168D082FEEF6F1A0C881637E3D8689DBFB301B2A41B
SHA-512:	3FAA652B25D1FCC7EA0D6F2E82E4FA564540DFB95EF051E906E9F4AF0F61A243B3E326E3E74C797970BDA99844755808E2C095692DE71C24C589EF94CB60AEAE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b538a131d6646c0b1a7055fe6197cfe.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73362BS7IxO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3884247737149575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrwEGWEGBc5Lgrvsjx:SbFuFyLVIg1BG+f+MjGXJ+0josQu
MD5:	8BEAB984B88F24D504B5EA31A62C4267
SHA1:	06EB60D629190F0EF639A1273A895A7A927B6272
SHA-256:	5AEB76295C1A71172263F24392D1A1462CEBDBA42021833754910CCB61E34FBC
SHA-512:	FC78F19CF786C8A0470153D99F9173999A7CBA230A9DCDF6E66C50619E0CDB2833AFAA1112C5C32AE91BBB4A2CB9F6DD8CFE137E14CB33809CF3B48CE0F840C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=abcbc6c3a56446d69a5170142dd6b7ab.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73363J43sjR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4304538364324495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6eVhRxcHqgcQXARPXsi:SbFuFyLVIg1BAf+M6Kva+UjNALyAZD
MD5:	B31EEF97931D342EA7F4A714AC66D24E
SHA1:	7CF0A9D9CD48CA745C07B64C6C06374AC327266D
SHA-256:	163E927757F2695DB5C6FCB421E859ACE09D1A9CE4A98E998BA8D5EBED6B6291
SHA-512:	CD8517AA3221E046CF5A03F6DE7FC714E6169B0DA61EFA52BCE266F0FF9FF1A650C148A2E985F51590986E8D807EB1BF015B9865338C2C83F30645F08CC1A46B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f087025ae6e4bcc9b4764c9694c7e4b.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73364VtewkQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.507477808734735
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MOo8DDqcWWWjZcHcljX+:qgFq6g10+f+MOo8fqg4mAu
MD5:	0759D3C3E35851A61255F89E8DE725A7
SHA1:	C644FC3CCEFAA8D6713B1876A04F2F27A204E659
SHA-256:	EE1BC137275A08CA571988E28FC8B0D69827B8989BD1157FB05410386B0A7C88
SHA-512:	82DA793ACEB8B896474282C6C5F0C333095394346FE6C102B4FD2D6EE962BAC4166B906C9B9612FECC18C74C15317A0E319C35566392F9F28F14B8693E035C44
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c35bf1b15c841429dffd8de658134c7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:733656jKpTM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.469720961069022
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4bCXUUr17xUdfXsje:SbFuFyLVIg1BG+f+M4+Udf8jZcHcljX+
MD5:	552F6564CB065902532DAB58E325BAB5
SHA1:	816808978F2B19274412F0FC0DD280EF5D65E1D7
SHA-256:	B4E0A8290E2DE009785B914095258D51D0E4D8D8C2C3E3370888F7C5D171686C
SHA-512:	03C411134C3D046EBF33C722DC27D62CB3A5E61B74ED8841492F8A8F0CB71CA70C7F9EF7D48CDEA496562548BA769CE06BD5D9B8217396D260D09951866E5466
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=262359f3de114e9da1066aa105b4189c.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73366TyXa6M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4461871566649
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9oJ7ScpcjrDvRqjsV:SbFuFyLVIg1BG+f+Mm+c84jZcHcljX+
MD5:	ABF68F4EF137813EA95F9D92EF58A5DF
SHA1:	48DB0D1077059975B54F3E4EFA4F1A4A8AC90ACF
SHA-256:	688715D3A1AED4825A3FE4A11A097B5387C278212AB5D51386CC23BA83C28F2A
SHA-512:	777B3FCE69A518A88420DF08223F6F58C2106B6A9C2C8E80DA542F75B80A505AEC0D41EDD03D4194DDAE9DB15BAF212EC2BE2DD0282FA4BEA903FDF1FBD75B19
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=718eea9f101b486faf9ae9ec1cf303bd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73367FSOqjO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.46289626020534
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7D08dgnSzEUS1sjs2Ax:SbFuFyLVIg1BAf+Mc8dgnqomjNALyAZD
MD5:	B940DA014E43270E6E410FBD4FA50D87
SHA1:	97DE6172DDCC798E51CFCEE1924FE674D2320CA3
SHA-256:	A008433F51E1E4D331E1F22D15534FD912D249D316417B8E1A95F39DEF497FA8
SHA-512:	30165A76B21D1ACA5E7D1AB701D7491DE163DDCA6A059F54D39E30F41B907F8C368717E595C646CEEA3A69D1C6DBF12D461D042C955ABE617AB6D7B920717819
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=126bfde2e75945d8949373fada185620.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73368xe3MxQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.418120072309675
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MoSlXHJoi0jNALyAZD:qgFq6g1af+MoSlF2IZD
MD5:	FEBAFAC4F7D00D3C574DB4BC98051846
SHA1:	3D2EB28A1F5515FDCD5FB085884E7DC3BF095858
SHA-256:	DAF736080EC3730005D84624FF1E5A0BC82CA4C92431A67733DCBB30F76167DE
SHA-512:	3F6CAC25807508686A0E72A19671C4275A2CCEBBFC5B2FE5D0173CAD5A93ECCA667ACF4522CA07411B9CC945EB62C11813B580A5B8487E7EF882B0F8BC2EE94A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b85d629b0a2a489c9aac39893ba90c7e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:733699tCqzO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.453096157871323
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8P1h2QMT9R2uqjs2ALl:SbFuFyLVIg1BAf+M898PLqjNALyAZD
MD5:	E7725EC1EB223AC49CCFF4DA341511A6
SHA1:	124511D3998094EDC2EA53B25F18D19A93AA495E
SHA-256:	691613D39D5110EE597C192776D49D932DCB73DBFE402BBF504D7A2033188545
SHA-512:	E6D4E66C4BD46A743D1EF63F977F9EC5913C4FE0EAE000F155A8A22F715D26C79D97C28598A39C470BF926FFBD0BF8A4D39BABB11102F71587F6AD5B1A57C174
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68337c09fe75455d8acbde2602c34455.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73370ezglTO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.420807019532626
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzVH/3G85AXRDkRKglsi:SbFuFyLVIg1BAf+MNBCYRKg2jNALyAZD
MD5:	24F95BA909DDDE70B2454D954D9FA26E
SHA1:	EE6F0D718BBFE5F895724B1A889E79919C0EC395
SHA-256:	98D6FD6C96DCE982281C9E8F4B9E6DFFF6AD92934E28FDB77FC96A95C418886B
SHA-512:	1277257D831D7C9CDAA53D9682BFA42BA8B3CE13E4357054EFC260F7195C3F4F18823F3AE25C3A07A8BB459ECF6D0E7B6AC7810B01AA8AC28A2F5514D17926B5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f4c01b820334cafbf99e24f98cd74f0.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73371TXR47Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.422665874416261
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M+YPBDGEporqjNALyAZD:qgFq6g1af+MzPhTp9IZD
MD5:	2AEDCEA82F4FA85DDFC737B17966A43A
SHA1:	94709061A4A712BBAF5018113F8AEA3C459A099E
SHA-256:	C24BFF7D032F46B079BE285CB38827938792C21C70DED064EDA733AAE2C17F86
SHA-512:	F2FAE769CF2C2D2BA9E1111A08340FFE2CBE27E433AD8F7B5EBBD82A94B216F8432EF953321208FA4810C1B793C9E473C343A7E9D5F93A3CD8F50DB607AB3F10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d38247cd1934aa0aca219b9cb63bef1.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73372ksl4GQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.442031844930534
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M9XTedGOJpJ8jNdQIeXD:qgFq6g1af+M1TCGqJ+2D
MD5:	F9E028951104BE4034ACABC54375B64D
SHA1:	1A5E8C366F83AA31F92F2E945A05CC1ED831DC58
SHA-256:	2F790EA90364307B9AE36CE62E1F73EDB5312A53231A0A9669A849CBADB43F74
SHA-512:	D01F959D3465E7402E6B1D4DBBE1949F946831122D1467D57825EC2434B25E3FD595482672B3399878C672EE8A0A265B2A77B565940F3A0608F053F9F0D50584
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=573da584f2c141a1b8cde11f6435aecc.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:734698k2dkR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.392928168413151
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MWaESDdPE+SN2jNTZD:qgFq6g1af+MW6SMTZD
MD5:	8755834A12FF33511A45994BCCA2C6C9
SHA1:	0D2D0613A26A164D5FDDCC8954D4B68C98ADDDA8
SHA-256:	D0CCB93F2169CCC84C68C9E6D77236672A5B2749E62808BE76EB09060E2A9FEC
SHA-512:	9C86706DE85951A2150843BA063A8AB485F088F53FE1F8759200095F1DF545C4AF64B73FDEB2DB820C59969040EB2D60925B916628B16FE430C3F77951221643
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7fee6fe1a7844d86ac16f35ffab26db1.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73470zKkLqO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4295177081433454
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+HP7ydRwD0XY+sjsc:SbFuFyLVIg1BG+f+M+HWX40kjosQu
MD5:	44E1FC6D2D567987DB93DD784ABAB506
SHA1:	F84FDC7E6193091037D637DCC6BD6644CA470AE4
SHA-256:	F8462DCC87263C62C2959A24752ECCFCC19B8C8DFA318468FCE2C5F67008FF88
SHA-512:	F39133352FB9737C813949ED4A8B14C9AC61B43B4DE2A898B84519FB48102065B31A0B4B7BAE469789A5FEE6E7A2E136FCC497EB9CBF813E39F822F93DE4846C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49cf4753c1304804a1a5c85b6133aa82.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73503esAMaO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.498386899643826
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp3oY9dV8QMlqjsicN:SbFuFyLVIg1BG+f+M/9M/4jZcHcljX+
MD5:	C2E9A5AFC7B98EE293C1B2309906A9E4
SHA1:	8951382B69EEA3C04A232EAC4BD4D5BAF539935B
SHA-256:	44D6F0D5B9F99B28AB56DF0F0DC863DA80D3D228F5369419AE4E5E9E961F79A6
SHA-512:	B50BD5B702E8CE5BEF725831182A2F216AE8BADCCC7F5C54B7B744767DE65E1BD992018F5F330FA492F3AD05C14B3646A302E8949F3BE178371F1B69631A4683
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce71405c15d54080b928f1c45567fe6f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:73514D5uOSP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.415950758562596
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5AIAd0AwidRHGGY+N:SbFuFyLVIg1BG+f+M6IASAfRiTjLkGq
MD5:	FECE30F8AACAA04873558A05C97F4E4B
SHA1:	DD1C0E9B308E720959A3A048A8F18B91C711317B
SHA-256:	CD230C2E0BABE02E1DB7D0A17597378B008842CB88F835ED580402D3858DA561
SHA-512:	5CFD35F1FF6805946459798F54C03D8489CC1BCF3C21603E720CB9FED425F71C2A293132A4268F91BF199CD12D0CAF2AA2ECD15B0406965A787A00FDEC88D00A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3c2bf2b98e8e48709da5af4f84b7c9dc.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:73515rxDCUP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4864557177364235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm780eB2lGfTjswxJBU:SbFuFyLVIg1BG+f+Mwx8IfTjLTTIWTIL
MD5:	0AD7D3DD8E280571994539D84E586E16
SHA1:	74BAB7BF99742311AD3EAE7310AB71B912AB3040
SHA-256:	88F9915E768444BD4248C36B202C2656E674276671C9EE9FD3D974D44137BAA3
SHA-512:	135D41B1871BCE2DFCC7CC4669910891C7799D5B32E16640272B856008C1CD74E030EFC04B6F0667F82B2398A7CEC967C25CD6D3613CC78102DF31ABD8E271D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=103b1784d8824f8db29b95597756f1ae.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:73520DzzxiO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.399813804127004
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8VUlB8mBaxsjshKJg:SbFuFyLVIg1BG+f+M8V+DUqjbVC
MD5:	34C3C509391C6EF6AC362658D16D15C8
SHA1:	39E336E7460B85F000B1246D6FB42BC79E3016F3
SHA-256:	A31CEBDFB2087628B46CBCD72D868C51940D34D4D2B3AA879080ECBF113156F1
SHA-512:	86EF19965C6925D28B448F7849513A117B928292EAD5C4A3D89F640B75F1B151ADC31A99AE663C37698C04DC9516F2CC0E82F3CE6BC7EF3A103941EFF674803C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=62ac281d63c14c4abd8fc6d15ed55f13.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:73561V1WF5O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.432596752174099
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmoEOnTBCJNVdjs2q:SbFuFyLVK6g7/+BG+f+Mo1nTBuVdjNq
MD5:	3A82A50B97571F0A412D1679401A69A9
SHA1:	367B4D8A6AC2DC2B8053D6368BF877BE21072EEE
SHA-256:	66BCEEF07F6B0CB0E74EDD2D2AEE0038A5A427120220EB5134511B09A69E99AD
SHA-512:	E7185EA70B2A9A3C4812EC13A92C9B12A93852CB63BDFB22BEFF6A92A296858BE91C64F09DDD8D3ADAB5F1232A0095724B48ADD67829C02C6CD07EB32EBD992A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba124d936de8497b90c68a4f882e0b65.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:73562T9KTNO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4233179244066285
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzHc3HTZdzMEXChs:SbFuFyLVI6g7/+BG+f+M7c3zjpyZjNq
MD5:	FAA09CCC64368C42F633489350A5F7C7
SHA1:	987CDF3B1F6AF8B9C0A2B77D46659FC0491323D0
SHA-256:	9DBAE7F920709245C84D602A43E24EBED75AB66FA0AE9BA587F6AE1C9FA4B692
SHA-512:	3C965B5BDFEA6B7F4D0798CCAD07CB9A42970114FFE493C1CAF3A8BE465165A7C7F818914877C554F18FD393DB8A4119D1BD19A1D1C60231A32137195A33D9BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9afb39e7bd6b4d398013829a9b482c42.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:73575UEcuHO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.490826573087362
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4BRsWHueZjFQMzKaBu:qgFqo6g7/+0+f+M4BqFcTmh
MD5:	6F32BC4C150C2031B7B240F38450C8D7
SHA1:	C3660ABD430764D77BD742A629D9B7B25F0CCF73
SHA-256:	F37EEE9D159A0D3A35A2067588F5EB55132BCB9EDAF0E2C78C57EC710A561B04
SHA-512:	15370693656C2910DADFB006D4DB6C496291ABB53AFA2C2695DE1FB3C49079551A12C18494AF50B054B6FE49AC6FEEE50B2633FE7F930658DE6D6BD3B6A4D115
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2db420c2328b41a88da5b3ca84643498.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:73576dh7brP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.498724475990714
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MwuA2dO2jFQMzKaBu:qgFqdg7/+0+f+MJTmh
MD5:	D0DAEF03FCEE79872AF286543D8353A6
SHA1:	AFD544947955AEB2A758259BFDC9B6BFB0AC361A
SHA-256:	85D4C053FCCABD875FD96BACFDB3F7A6D89EA6D95E4D432BA6D14889E4885CA2
SHA-512:	CC30B1A9370F7691B65D6AA4E288BDD91F0D40AFAA206C8109FDFF5A1F3DCE74F82132DD6D74B68B1B7AED936B66C6DD842F77EE9BD957FD1253EBC946FE7320
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90d6427382684e3a8e36f34b82c9428e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:7362008SbwN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.358991181377042
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvkKnTQW9sz+sjs1Ha:SbFuFyLVIg1BG+f+M8+cSs3joa
MD5:	26F92A113A93209F1AEF6A11B46092C1
SHA1:	B52518F2D4E8A1D04D5EEA00AE066081B9675777
SHA-256:	317B958D831A460315A6D51AFF113ADBC151BD370B6BD0D66F210FE7048C9970
SHA-512:	6CAA8C183241B57F4A2EAC34977FA14EE2495E84EBCA8227BE007ABA8F1646A5AE2018BC22AE805F6889F4E7975EB60B9BF2F94DE8A47ACC13476AD866F4EDB4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e902496d0f6a4c6cbc4e93c19b986a8b.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:73657mO1qhO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.326535785234605
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmv1XkBT8NmWf5xsZ:SbFuFyLVK6g7/+BG+f+MKBOmg5qjN3r
MD5:	D77A4C81492C58AA381679D177577753
SHA1:	765A23651A90289098CE0AF190D69F7FC0B0D716
SHA-256:	3A2862B72E1B5467BBE0EEEEAC1CD625F22A0533BA3B971A3C48E95C8448C5EB
SHA-512:	469F1ECD47D58AE4C08761E68704A851436464C5FD68775AFD6D792F03861892479D6DD453C5E05C0847FFE2EFF08E403317623FA420815C188E82B9A6635F2A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9a2edd603e54d278e2ac0a5f1e01d8c.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:73687AynraR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.442492312537503
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm+LtD1gXAtxsjs+M:SbFuFyLVK6g7/+BG+f+M+BDOjjFmzXvn
MD5:	9E7A63D1DE40B00E9B2DC36D6CF3264F
SHA1:	E78EDBAC5F9741E0C698971C624F3297A4955E97
SHA-256:	D835575B763D0AEC64D3E0240BE19E9B85E4C2C4AE0D38E19016E85128F336F5
SHA-512:	43A182C71B61230388ED0945573540852F77D531B69992459F3B599FF15C1C74C5523AD0C9E1559C2F12B1FE5D128D290AC1522A9D3C952422A81AFB5ADE9DA4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49fe2d499f85459e86ab165b2653e972.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:7368869TlDP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.428637812871669
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4unEuu8jFmzXvn:qgFqdg7/+0+f+M46E52QXvn
MD5:	5F8253B98F512912FFC1280A66AF4968
SHA1:	4AF09C2D96B2E6680A8E1F1DC385D473EC8116F1
SHA-256:	D21DF29FDD52ACB2B2559F812E6351FBC42E4EFED7E74FE33422DACF255E2919
SHA-512:	616702828DD2F31BD44A596D9FCAEDD9748AE6CCB8CDABA9650147C969DAFBF3847FBF04769689A0D94602C96F11D4CB0CA25B64914F0400019449B7F67A45DE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=25cffbf64a9740a999c5ef7478ad9f35.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:74699bcKvZM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.373178532234957
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MpEgVDnTFR8jNq:qgFqo6g7/+0+f+MplnTFR+q
MD5:	D1DAB542404383D741B294BF617D29AD
SHA1:	BF95E0800A2B5C061B6346103EBDAA62A898FF78
SHA-256:	8010CF31BE7C8435AA82E32CDF5530186DD236B3449E9D340C3ECF2720DFD9B6
SHA-512:	5EF61B23ECE4EA82A6165CDB94EE5651656F86A02092B19BCB2D26C3D4ED20002F5BB23B8E582EB9A79CFCF62688AE6DFBD95AB09B6BCD9B35CC8E6EA94AA28D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5aaa90ab7ecb482faa038ce8ef2d3e60.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:74701tLLj3Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.360075165250629
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsBDsyW9Afqjs2BI:SbFuFyLVI6g7/+BG+f+MsB4F9AfqjNq
MD5:	64197C972C2D408472410E892716AFB9
SHA1:	1261D266C788CC50C7EE8D09E3BDEDCBE3FCC4D0
SHA-256:	81377D0477671E1DA06451E5C903182589A5973D09C1C55586F11495068458D7
SHA-512:	9A0E6AD961A4FE8201B689DCBEA3A4CF03AE0B2FBA10B9C5136FD530E922AB533ECE62915EE09AD564D1EE13347A126B1976809934087FA79BAF4C3800C6C862
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fdf337dc5ae84c70af8f3ff0e595e538.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:75143vJcdEP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.370723546252051
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MKJEyHQykjdcjemEg:qgFq6g10+f+MWwxOemEg
MD5:	8C04B6B1BE2E23C3CF4F55476D7D75AD
SHA1:	71829090C91797D3CAAAB3B3BA9A5F2ECBB3712F
SHA-256:	F45811ED755C76FEB860088A38C82BA0D9691C5F02DB6C967360010BAC95916F
SHA-512:	04D2796EB12246B3453649FC708C3359A74A34CF1C9067B852C60BA6EF1BAD7966603DA6FAC7B5E1B44B00696E0AE656332BE23440485CD32F297B36FEAA22F9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=37e3525ec1be42aeb46d05415ee41aa8.IDENTIFIER=wpa_supplicant.UNIT=wpa_supplicant.service.

/run/systemd/journal/streams/.#9:75255NF4GcQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.393450925568251
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/fWDJBc5vBd1jRxsK:SbFuFyLVIg1BG+f+MmoRBbIjLIiAvAW
MD5:	DE9A9E8E279C057F4C55D7022E0A1167
SHA1:	0F3C3469F985FD06145BE07D9E7E754A0719A3B7
SHA-256:	2C237FCC7177BE6CDBB80DBCA58E735ADA8510ABF4CAA88250C7D97E621A265F
SHA-512:	D7D578B7283B37CC80ABC643751C0BE8B199D49672391BECC543767DB5E92D94C3E1CFCEE2296FDC04D1705EE01A6D42AE7B3AE42C9532B9671ECAFAF48B2CEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5889253531524950955ec7dcf889aa72.IDENTIFIER=avahi-daemon.UNIT=avahi-daemon.service.

/run/systemd/journal/streams/.#9:75381o8mqjO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.3946592919854295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpjABo2YYZrqjshEGR:SbFuFyLVIg1BG+f+MrHrjuTt
MD5:	3032DFC5E75D7500C6B3C44E2FF30A65
SHA1:	73AFFBAA27A6154F54E1FFAECC48152719D84289
SHA-256:	980D6EA5A87D0177C4163277E493F12A28E9780138FFEDBF488A31687D3D9654
SHA-512:	F4CFC3A3EF85D908F6F5B30F2C72AE7ADFAF6BD86A8BB4475736D6879AA55B2A660538410DDFD384F14EE3E69D91E790F7A9609C1B07CC795EF6757E53303BA9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1c26bedd98f44a6ae26e578ad8d4736.IDENTIFIER=packagekitd.UNIT=packagekit.service.

/run/systemd/journal/streams/.#9:754145ZO6vQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.427815388156158
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MksKzKz8jFmShmWc0vn:qgFqo6g7/+0+f+Mg9kWc0vn
MD5:	2A7C250F81E0D91F06C360FC8857AF13
SHA1:	F13F809794DCC4F787767291E8E1D6514BA9D0D0
SHA-256:	CB336FE53F68F82E4F9D6A99B624112EA896262F93E32D3638A4343C21F6655B
SHA-512:	5EE21C275F86CB346017E39966F0D8D1C856CAF94EA918C07B20AD14E0BCABD810A5289E89959072257EF293D68F034FDC2152D463D6B585459A6EECF6295350
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a75a7532739843cfa502dacbbfe6c526.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:75415mSwt6P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.412549083885347
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MpozxRqjFmShmWc0vn:qgFqdg7/+0+f+MpoV29kWc0vn
MD5:	FF9B8BE4E4E387A3BE203A1D0DF6EFF2
SHA1:	E664599E4A1B5F377506035B1F29C0E06944D9BA
SHA-256:	6759B92A6A2200D4F40074640CAE5D85554F3A407F42C4BCEB90688AE7050C18
SHA-512:	086AE1EADBF37B249CEC04F53CD09BA5BD57B42747705E568A630EAC3BD837C3543C6658BB9EF4B3CD2160811CC5AA378F9078AEE9544CC6132F2B87063061CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91fdda56b704465a9712f4f0e7396905.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:75436KDQKLQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.468439764244348
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoTVjFmShmVxfvn:qgFqo6g7/+0+f+M0L9kVxfvn
MD5:	FAE97743E4C3ED0F58059DECDE001861
SHA1:	0A21F3E5A3F460132B9CDCC126BCD193607B1209
SHA-256:	8F40042204A1C3327F9B7B7A244EEEB746E5D0055F57FCFAE95DE05490C1CB99
SHA-512:	7788020C1B0BE5AD8FF287785BE66421D6A1F42058541B7A094FABE6E63772E53E700A1FE742D700294C355B92B98F3F04B090E10B8488BFF4BE6CAAEF8C0B2A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f3035b2f7a84c0d88f9571db1f21932.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:754385NMzZM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.447210653003324
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MRHjOthHIjFmShmVxfvn:qgFqdg7/+0+f+MhjOzi9kVxfvn
MD5:	0520E34264AF8F6D877FB67C08EB0CA7
SHA1:	82F382B228720D1BC22B0B77F3C7141BDCB84DE4
SHA-256:	E45E87F439F76FD738DEA979F7E4B54E6765A354963D44AD8278D6ECAC4C2664
SHA-512:	828091607C517E0CA87AE37C0EBE896220E063260E1D8946F23410E22A5B2205AB84461889419F1C5E74619895BECF5188E2F149045FF6E0BDE815DDAB41423E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9c83e3b027354127aeed695ce78f82b6.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:75455tOyGoQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.436631668703558
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MOFdXv8jFmShmDxfvn:qgFqo6g7/+0+f+M6pv29kDBvn
MD5:	7FBCFFBFE4D55E58D6E51EE10DA77D99
SHA1:	CFF7D63C4BCA7D1ED66B04649C539D1720E849A5
SHA-256:	14B3392E3877994009BBB6F37FBE5A4EEF79CDC988AA92A6A662675CE650DE8F
SHA-512:	E0046C247376A01D563CA9A9CAA9AA37D37A0431C792B7D0FC346BD35FD97C97DC0E24FCB6FB4A3855798F9AFE720903105FFF16E00FC42E0A0A15D7DBA32EE9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5341199b774940a9a5f67899062b8a98.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:75456BEC6FO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.444897629045306
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+rJBCj0jFmShmDxfvn:qgFqdg7/+0+f+MQO+9kDBvn
MD5:	9F2CD4DDCF8788FD7049E16325AF391A
SHA1:	D02FA4A7F3F61DE195FA7C9CA278D6372229B7A5
SHA-256:	181BE0E0147A60C433381F5F11996D465489E65471167B06F402ADC45FB8FED7
SHA-512:	92DEE31D7F3CDAF3EE778D0F12E86E7B923A6D0B617521DD2A3494DE05B579CB007E232A4D11035C10E2AB78ADA3672AB46779EA7287C16F267CA62A0470ED78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a6e9e18c95d4e248453fc8f691178f9.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:75457yqTX3N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.431078144251757
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+70skGZjFmShmxBrvn:qgFqo6g7/+0+f+MEv9kxBvn
MD5:	3AAC7AA90E2A882E756698B62A1CE330
SHA1:	8081510F75489C823E812C171362F6ED3D3F16BA
SHA-256:	C17A113AEEB3303146E944FFA9FC99D696C8641D5E10F9874A1C5588C2B60508
SHA-512:	2C3F0898D034B3225E663BCDB1C124ACABAF87E232C0167629C987C73E4D80F628138144FB0492FC2176C727D1581D8849B45351116DF3D1B8275EF955FB969F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=43f77bc03a5a4ec886e6ad53452bb62d.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:75458Z5wsjN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.43867362887123
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MeEEuLt2jFmShmxBrvn:qgFqdg7/+0+f+MpPLtE9kxBvn
MD5:	63D3FD1433679DEFEDB229C2C6F9A4E7
SHA1:	0E496238135035D333B84832C95429DC33288AAC
SHA-256:	56240CFEA9A6596E5BE67B18BD7F2C4054651603B4001F66CF9501B93F8BCE06
SHA-512:	FB446135A48D4871D57FA92558717C5C521926FAFB477455CFDF34A3C4A99B9A50124FC122E802C0A06A0B668442224141EC6ADAE591CAFF9368F38A95F55A49
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59555465f2894663a0b382b3f22d62b4.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:75459QWA8XN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.44476420305888
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyYpkvz8jFmShm5PKJ0vn:qgFqo6g7/+0+f+MNIz29kYJ0vn
MD5:	61DE82CC758E3C06B446C63677125034
SHA1:	E76638FDA95232AEE9956DDC4B484223825DF8E3
SHA-256:	82A1BC3BB7BF90C2218C48A38CA45970D11922ED8783619D04EBAFEAC52D8F6B
SHA-512:	C7F51EAACFBCE601E4D539532F6408908949E351EB86E2634E222279BC92BA714F29635B27476FE7AFBC099F0EDCDA0372585B12A0417B8B0F3DFD5047953FEB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b07d4d9747b4f26bbcbd8959c735042.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:75460k8FuCO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.370858592150369
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MkGBrX4mVbqjFmShm5PKJ0vn:qgFqdg7/+0+f+MPBfb49kYJ0vn
MD5:	D3B2B647030DFF7C1AEB66402C79B365
SHA1:	16FDD5EA2C99188AF5BCDD0158A5D32A210C5EEE
SHA-256:	38F5C2D63830BE98D81EE791E361BE25E01B35DF0D622D83C139F1D247BCBF38
SHA-512:	A78BF1143FA4549029B49EAE0C82761A948F49E271719335F10C27246AD9A8898B1C4247F89C4654B4465E24165AD2347901FA135CD4ACCEF6842CB8FE95DB6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce981d2cdc0c4002a350faba7a49209a.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:75482lEVK9M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.453171126964457
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mo24jpQXKRqjFmShmatvn:qgFqo6g7/+0+f+MoTxR49katvn
MD5:	17EA743CCFCC68E52CBF88C6ADD0BD73
SHA1:	8F51EBBB46267AF26C4BE9CE27F51F8FDC637850
SHA-256:	0877FA00E7C652E0DEB20A21D053C9F4337DB2A911CC3E3E9688940BCF89D076
SHA-512:	182F0E973D4E1ED9CE725B78B3C7EF0D31109837A576F9ADCBEEAD39DC573364DEEB92E6043E37CEE03049BCE934F99B7D1BE51887F0CF71497119A65D5005FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b449c9cc2b7b4710beb8722b0f32103e.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:75484u1WfpP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.463474657006969
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8Y6RlhjFmShmatvn:qgFqdg7/+0+f+M8YSn9katvn
MD5:	F243A8305066176714D4EF0614286216
SHA1:	8DA8931C8021FC3EA8875B23D7412D604FB07A50
SHA-256:	4A0289FBE793F7626D2D211D6FBE035D94283B0AF7B4D823E47CD4EE1494CE1D
SHA-512:	5657D7FD0E88B2B50A0AA4EEF43B79A33741118BA2594179B5962425532DDD024475CC8539FC9A99327B7A7F861B4AF942A45120D3376B6DEB36E365D6628B0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65e0b4b7fe4c471384629e2cab143814.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:75505WFrrdR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.377446060731418
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+HV9LuqjFmShmzxvvn:qgFqo6g7/+0+f+M+fu49kztvn
MD5:	3D64C9583A24F9180000A0041B835FC1
SHA1:	2B4860611AAF6B6CF3771ACC71EEACB042C7D348
SHA-256:	EB9DDD86382D1E0B43E11FDBD8CCF326C09AC49E2AEAF9E622C16D5B4E91A41D
SHA-512:	8E599830E18F2F5ABFE05228AACCC7682EED6529F2A3D1D4540B182BBC9B76FDD58B52DFCA41291C14E5B60C201C4A2D6E5C099A1C945B40200F53E78E254306
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eee350d173fb4ad78497a9ddaa515af7.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:755070p7R0P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.379352707844784
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M3WX522jFmShmzxvvn:qgFqdg7/+0+f+Mev9kztvn
MD5:	C9430EE5E92BC93AD91FA3764CB1B4AF
SHA1:	4C3FB20D4392F95812CF4B7C0AF8AB940B83C5D8
SHA-256:	4A2B2E97C1A593EC42A740BD540A20360D92C9EB55F0D720832E3EA122DA98EF
SHA-512:	C2F0487CBD6B1056B263AACBE2311599E5346CA3F9972EF4580776DCCE8EAD5F8519FB7A4ECA6094FADFA767FC8220B715EF0DB3A8AB909F2FBF41B4861498F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a1c87d406e9e4eefa8863094a8e26f45.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:755081zidhR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.3792289057747835
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M10GXlQjFmShmZBvn:qgFqo6g7/+0+f+M10aa9kZBvn
MD5:	29C4E3E786DB8333BB273DB737D6CF8D
SHA1:	BB5043F0421F0057F9DC9B721878F880535739C2
SHA-256:	5178DB94F2DA5A2D6B0D1B52E8FC08F3CE0F9A91474EAF9B7BA3FD1AF3734D9D
SHA-512:	7D87498017BBDE86E89EACEC1F674C0D6D3425868C4D4EECA2ACFCF2319E1A50A3D9A427D38A99721BBAE7E06AAB5D253284727F31286952A8DAB032A468D3CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75d13f9989d748d2a5aad250dfee1142.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:75509P4TxUN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.374346781781883
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+faoTjFmShmZBvn:qgFqdg7/+0+f+M+b9kZBvn
MD5:	EAA517C7F22CF9616EC1E66FAB9ED1CB
SHA1:	83EF0072BB45E53D9461160E4BBE1643E97D4D2A
SHA-256:	3C22DBFFCF7EC660DA7EA090B34AB5502D2838D3B4FDFDBF7B446CE98EAD60BA
SHA-512:	A43B2886A37625A8759608639A3D6C344C07FF550ED21200A1D79F73BDEAEF2DFB849B2EE1283E7271085FB08EB2A08CA39014C9563AD1AE5013BDC77CDEEDA0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f69be16bd244b8f8aa6b99469e4cbb2.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:75530Sc3pYN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.4627875714926954
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4znzpjFmShmwtvn:qgFqo6g7/+0+f+M4znL9kwtvn
MD5:	414DC56FBCB2845ABE5C4BD1F63B0B4D
SHA1:	6CECB8F4EED0C64352F5ED8A037FDD93CD05D29B
SHA-256:	AA6B85E0257E28329570C100EBD1B5D818E26FE86923157E852A08A737602FB2
SHA-512:	04E8798425D2BCC81E04EAAF8BAC0915A1D5CD1BF7D7071EF1C99BDA8CFE578C03E049B5B6E964D214C0B089B1E9429566FF3F75327B52C34A3CF5A07A0AB5F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=99e053f81c5642698279a3b3a262b79d.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:75532Tev78N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.400452026038799
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8BARTfh0H2TTv8jFmShmwtvn:qgFqdg7/+0+f+M8BARTJ0WTC9kwtvn
MD5:	85E8C67DAB911452633C073F31F665B9
SHA1:	75C467CC7A016E5E7C63D5EF2585972B6179D4ED
SHA-256:	A69C14D66220E61BC11DD024762E8A1873C0F3F0B82201EF8642852CA1B12BAD
SHA-512:	0902059F3DCADBD6691280A3E0A721BA5F70E5E2CFF80B2A4C2C49D7EA5D15B6EF4D6A5E7413CC6ABBBB998DF1A9E38511029ABC7F30205CC11263FA552DE32A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6de468e9743c4975bb3b4bbef0e3bb66.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:75554AJRucP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.452791428886341
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M46xK6Xt1eRqjFmShmkiEovn:qgFqo6g7/+0+f+Mt9449kVEovn
MD5:	2C7C61894A87893628A41DD0C802E7CD
SHA1:	F8E31D3C54D945DA445E60130AAEB2ADC2C70A7C
SHA-256:	9019FBBEABEC4B575ABF82B5552DC06D637FC965FA596D0F94FE495942F1F307
SHA-512:	E4A2C8BE121B7B4455B102D6FD86F401DC1C50D2C8F0BFC7749593B68747E3FFF16528AF57AC4AD6C98EB558E53D13DA7D772835EFABBF8A9F838EFEC917AA50
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72aea8353d344942bb60fb5a628ca9a9.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:75556pKG2SO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.502057195552121
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M47lGqQQNh22jFmShmkiEovn:qgFqdg7/+0+f+M4oqQVE9kVEovn
MD5:	7EA037C00DB2F8C13DFAC97D88BD4C9F
SHA1:	C25B4B26193ED48258A22AE46CDC15C9FDBF075B
SHA-256:	67488CDAC5174A43FE3A91795A62177F521B045AFC43B7E274248D55F6A8804D
SHA-512:	B2070668419E7833783C75832AEEE43B772842CC382A29CC1A7012D0C7B0FB6353E623505008D8C79BEB63463A01BD58EA250A2DEE3AC2A65710E8A19181295A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=27cf786f5fd64fcd9320898132dfb10b.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:75577C0bZAO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.412853341617684
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MvSFTFjFmShmpvn:qgFqo6g7/+0+f+MKFT79kpvn
MD5:	5F70BDC3B58623B3AB4E2600D53EC486
SHA1:	E79C806DD8798C840BCA7C3465AE9A0E1D64DC9B
SHA-256:	E5F5ADB4B795C77A47675DEEA84A8CE6BBEFF79DB8C9DB73DBCA754359AB2A02
SHA-512:	58F37C4919A2A19D311BE56B61A329A508FF70C03973ECFA6B899EFEA29067342534FF8CC43A7E9434479E0A0C24516FB45D7A64464B6394210AC631C73AB95E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5f6a0217d6f548279679ab6ea2f1567d.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:75579x6lu3Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.368816453132285
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+gTIfKN2jFmShmpvn:qgFqdg7/+0+f+MJ5+9kpvn
MD5:	8E37ADDFE56B0759813EF543D81B7018
SHA1:	115AE165F2DA3E15219FF4970C4516F3C48DD6E6
SHA-256:	0D314401471A79E0E982EBDE85E455038CDEE30BC935FDE55206E51935C3CB4D
SHA-512:	BAA5475D1847E73CF813C8E5F6A783D6B0238672DD4C9886BC6C5D3F3AAC011C4D2F185E42F1BFF486897392CA5449F35BC3117C22C2E9AF93B287C919D4290E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a44c43678c84ccaa1e70a6681e681b6.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:75600gj2UYP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.417281577167467
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MY3HAIig2jFmShmQmc0vn:qgFqo6g7/+0+f+MmHlE9kQmtvn
MD5:	F171D0970861E9E395697DCE60EB8D27
SHA1:	5766879A3C180A95AF47E88E1DF9BDE2A6C15FBE
SHA-256:	7BEA2E44C339696F32267D0BA1BBEAC68D5C9110BA4BDBA9321FA5C46D3D5437
SHA-512:	8F873D73814C00797017500794C1D335EFD9C21A712491FF394EE8227E50676AFF591FD1D900A6F955D67CD5C63A75F1EC564FA74BC9758AE0533E87E7803AA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3eb8fdbea6614ab684594e621da053dc.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:75602bCdMQP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.432232687162887
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MjUR/DTYCPjFmShmQmc0vn:qgFqdg7/+0+f+MoR/DUC59kQmtvn
MD5:	C85D3FDE11D1021300DDFB765D9152C4
SHA1:	0FF11264AADA85137EB1844094A364DA73A8193C
SHA-256:	9B45DFF9477C346843314F8DDA1D16C739F06F94C4AB47D7253422FC19387226
SHA-512:	69BEFAFEABF58A3619E2F2E01219788B47F011BEDA27F4BF0C3B1754EE846D73DC2D71B5C42CDBA42D28E82CE56FAEC0A700814DAB7B3C13D3E8C07991BFB416
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5654a814962543a6bc53149b8e1f0a81.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:75626yFhMAN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.477394090536596
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MlU2cW8jFmShmx+0vn:qgFqo6g7/+0+f+Ml4b9k40vn
MD5:	74296FB448932A483FB8E159C85EA8AA
SHA1:	715C5FA0E3F7849BA47A51344454500CE2C6128E
SHA-256:	D195EEFA0629DF55700E763C1B20F9F24BC8E6A8FB9DC5873CC6C438FD684C28
SHA-512:	E3591E21E2615EBD88F29137A6D7CD8ECA90B2CA12FBB03EDC44BF0498C49F0B167A117971DDA10EE79B5805AD6AE2254EE07CC955B22C2DDE18310F0EED5384
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=157440bf1f9b45ed96539d3b2d73847b.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:75631zcNcaP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.46688806335002
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mygp9euLNCdTjFmShmx+0vn:qgFqdg7/+0+f+Mb9jMz9k40vn
MD5:	3B6B5B69FFCB61DF2B1D900D14C191D0
SHA1:	AA78EB17EAF1ECB1E880D8B4437822EA57AD5B10
SHA-256:	D6E465CFE066F92E7B3D6987978AC465C1415B272B735A2E8A5DDD8764298D56
SHA-512:	885D7383F00EB453A3893FB17CDD859DDD1058B5E88B66C040EFA045DA5605396C96FCE05F39D0EFE93BB899118A53CA151ACE96FE976142DEE362749DBC779C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=84c0ff512c744a2fab6b1b71c023516e.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:756324xuRCN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.460368427065231
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MCnp8TgBZjFmShm3vn:qgFqo6g7/+0+f+MCCEd9k3vn
MD5:	497A6384FA4A3A3683CB9057C7B8DAA1
SHA1:	19C6CE0CCCF46F287BED30A9E2B6FD189158532C
SHA-256:	D0BBC4AFD6DFECFCEBC8B3B3AD7C2ECFEC03AE002750CAFD7C4D322092885B0D
SHA-512:	06B8C8DAA9D7C117DC0D123156910B5F4F70367538657EE360BD304D947AA3A347CAE3391635B7B4FC6433059AA5C8E1D9A4A1C5DF82979F2FD9A844E47A6CE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a2b4dc515fb4704875635e41962b300.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:75635SchmKN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.418072687856856
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MSUXOG8jFmShm3vn:qgFqdg7/+0+f+MR+59k3vn
MD5:	9686B3FFDC59826844A608BA3DC7878D
SHA1:	D9676D101A05722E399240CA2385719D47114143
SHA-256:	6AE0198D0257A7D84E47E5BF3AF3844D719C72D663ED2E0422D6D41953891C6D
SHA-512:	AF8005402CEDE582B2A61ED0D091B3B4DA30633B690A0EEDF859149F964234308977113DCA1D6694FF5A79A7F7738CB2F94A04012C879B65F9CD182DF6DFBE8D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9bcd5a538e284fa5826f8d06653de348.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:75651ypQ5PM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.415403958572795
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M/QW323XjZcHdzqDq:qgFq6g10+f+M1G3NmQDq
MD5:	803EB065CDCA54B151297A27A2692881
SHA1:	D0A453CA63C8F595051F49A1C92D8ACC4F0B8751
SHA-256:	0B5AE10597CA316EFB802BB9201A2757FE3C0FCA1843F4F1951F4A2DFBBEB358
SHA-512:	5EC81E0B61EE66FD10DC01BBC4A833C2E6B4B0853C0C0572E891144C4436AB68F83913B18973ADEE5E0122A930F53305CF32438C28F966252089ADC02B4C14D8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f001be5ced44738964bb2eb10970eeb.IDENTIFIER=systemd-hostnamed.UNIT=systemd-hostnamed.service.

/run/systemd/journal/streams/.#9:75806X7tJpO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.47972396035502
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4XPcqcxGsZjFQMzKYA9:qgFqo6g7/+0+f+M4/cqcs2Tmt9
MD5:	4C09ED7330A83E489347259E6B2C5784
SHA1:	2C7B880533F4C68121B06F18166D6BD2E95CC434
SHA-256:	317280F31DCEC5A80E9DAAEC5A932BE7B31FF7E7F3343F59A543F8B4C6C4DB79
SHA-512:	20948496169BBDB447E0BEF97EA182FCB2DB185213F04AE948D3C552BAD28AB2EC2DBCEB7F519DAAE043851CC222D70F0E439705A09EEAB0BD2146CCEC009E45
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e2acf3074804e17ac3109727608cd3a.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:75808EntdyO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.476513068041031
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsD0IUlKj38jFQMzKYA9:qgFqdg7/+0+f+MsqTmt9
MD5:	9FE456CC15E08A597F94959A3ED92093
SHA1:	2970AD1CCF78166A0D827DA997184AB90FB0B1E0
SHA-256:	159BD9DD4822665307EE4E7C8F13387903D7C841778BC145F77F156594D0814D
SHA-512:	D747D16E58560E4296A2C44A56AA0E61C9B06151966AAAE99A913CA2C8966BEFB96C52B87F54C5402C10B0BA4CF35605383520726CEAA696C84C7C3F5EC2C96D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff2fbe14beb543e494f5cf528f158c4e.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:76009ap7pkR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.355534601046851
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm+MX0WBRGSsMlhg2:SbFuFyLVK6g7/+BG+f+M+MXtBRGRZ2jV
MD5:	E675207F60F68F669968EF6090D6A717
SHA1:	2307DBEA011B9D53E5DAFA6E2C443BA4F7121BAC
SHA-256:	4D766B7761C27B401EA42CE18166A0BF48A95CE235B59D4B5DCE1DEE2C574557
SHA-512:	E4F11E5FB6F5358A262C053BB4B1795968D7653F8CF61645442848F8FCF89D17BC03A654D0DBC59606EE4CEDE6CB864E2B99A410CD9D075D974105FC55E6CBE6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4b1dd2e5de564dd48a719be86d1c3007.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:76338niHqTM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.409542685604456
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MOIX4YTjFmzXvn:qgFqo6g7/+0+f+MOo4YNQXvn
MD5:	773834CF74126351EC3114DB0D3EBBB6
SHA1:	DDB0D012EE1C8C2993DC95B4A91C50FD68D5C95B
SHA-256:	6734354C76E6A021739D0E5AE94C9A04F456728695A56165A658D7E0DECB834B
SHA-512:	E15B81DE307E2A16C0512EEED4AB8F51D005276E5356E23ECB78B6EB634D191ABC39FE61AC52142D16B4C1DC7D5C8411F51D0224CC9C276B263B1C9448C020E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32e6f50a582648938cbc03aea8b29066.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76340I6FeyP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.440460452754669
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+lH2fd3STRfUH0jFmzXvn:qgFqdg7/+0+f+MZoWeQXvn
MD5:	DC018198CA2D2BF306C9DA609CE4F1DB
SHA1:	7D757C3B3C95B62945919B8B5D04513C206A6978
SHA-256:	53875A39D351B64948EE634F4AF08533C2A0C29943E74A1058C4A96AADBC16B5
SHA-512:	74FF710E3CE7067359E2FEAA20AC9A0644C00BA36B674B96E8A65ABA14F2D6E3D5B47E0AD867CC156CBA1D733921790742C0C2ECA42FC3BEBE9DF8E0A0DB0B92
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e49b092acef475c9b5fb767c62d661b.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:7643994pd1M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3888084936701635
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm71RrQomAA8hR5qjs4:SbFuFyLVIg1BG+f+MPrQrl8H0joa
MD5:	4BE1D7838ACCE62087F1B22E2A9432D2
SHA1:	8A0A38F080434AE3D6BDB0FBECDD0CF2F3726C1B
SHA-256:	A06533A587BC2477AEDD3A9BB6E88B7CF4DB02A57581465FA9050DA8244303FF
SHA-512:	0588CB3CB5B3D932BD2C195D24BB4EAE46F21544C0F1499BFE1476D1C66003885DD7B2A0E2026B6EE8694F98FCC2BCB69EF3CA3FF7F50F6EAD71C1D5B1C76C54
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1df40d692e5743338269eb9a3eec1794.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:76440tIYZcR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.359264429422433
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4lBykRFCJoLvFlsjt:SbFuFyLVIg1BG+f+M4mkRFwoLvF2jtWQ
MD5:	8E4B6D3ACE187EF8BCCEE7843AF443CA
SHA1:	5C9CEB64CD3A8605CE8C21F506722B6A48CE9D0E
SHA-256:	6C910213B28153F457DD395631E496D6660E2806B1845D8C8B342785E06CC841
SHA-512:	3D0FC12398D34D0A5E41FCBB34F80B86867A392998062327085FECDBD66C338D5E3F078EDE03406A12DF3A60223C370CC91C04E33A5C68C49BF9E01F23BD2FCE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=24fd0f92416448b69bfaaf0c7774092b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76586BL0PkP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.443155236255755
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuwTkgFBxwRcOwZjsx:SbFuFyLVIg1BG+f+MuiONojNE
MD5:	9763F607468019CBF0EF4DF22A80FD72
SHA1:	B115042AFC52A7B66ABFF15AF37643B6709085B6
SHA-256:	E5E88EC06A244B6F6CC329EAE9866F6637F0E0FEAC6B2B6AAD532185E40C0D50
SHA-512:	68D8D6DA23C74F77AF129B7E928F6D25BA51A50DBD86C03F1B7030CF08BADD3E686FCBEA45C64D67BC7FF199346123C8FB2E8F61F13B71508D60A1DF30268ECF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d5006ba4ec2c4b6db8646d7b49c80f79.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76896BZfvSM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.465767274365064
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7qSRWNBJIXS+vsjsb:SbFuFyLVIg1BG+f+MW/vaCrjZcH5CHq
MD5:	AD99655269257B9FE905E8CD5ECA9724
SHA1:	74FBDC60B8EF5D8AF2E9668DC6374C7ECE53BB1D
SHA-256:	7FDCDC62448B6AC465BA300F4674212C2134B072D423F7E8ED91EAA5C918C11C
SHA-512:	6CE8DA0EE8573A11D2E32DB50F98A57FCC71F6BD34D4197117BC465D18481AA4C73548FF5BAF272A74CBA28063ABF4E8348FFD9443A5E03901EB8CA5853A4547
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=116c8786b93742cea27ef3c1514278c2.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:77006kkUkbQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.372323696695787
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8DWtGjwdzxLwsjske:SbFuFyLVIg1BG+f+M8i0sdRZjfGt
MD5:	CE95BFD857B43AEF4EC3497452581118
SHA1:	2D6636166795D6B32328D6B00F0DB269C9DACC2B
SHA-256:	8DC910F85A3C3FD33048BCA49E76B98C161199398E2D49296B11C7B074723C37
SHA-512:	7998044AAEDFA31DC35B41E286D120CCF2C169016BA9D80432923484D407E35D5A9D5F5E7653D1C76FCEC4DC2282CA641B427F881E7DAE4C39879BF260EE7A27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65381d1ab70740bcbbec500fd405be81.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:77049ZSM9jQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3581643969994515
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpjKwG8p8jshQJWL0:SbFuFyLVIg1BG+f+MUwGRjtWL0
MD5:	974B3CA2E933A595574E836D71DED0E8
SHA1:	DC7D27CDFFD60BC6AC854B0DEB0245A66D4B67E2
SHA-256:	A86E29D041111AACBA520B3491B6C635B4A438B8ADE93087077A320473D24CDF
SHA-512:	B60C1ECF89C1605C3DEB845FD38673CAABCBEFEB74198D1C536A24DF6C4059CAC1A60E849B8C06FC40AADC67851B7D295F16598900AC7041BFBEC56D1541F2EE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8aa576c4b1d4dc48fd6a9fba56f6ec7.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77088jurbVP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.389371218949403
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuDURHxPVC8hgrxsjQ:SbFuFyLVIg1BG+f+MuGX1jNALQru+u
MD5:	D435D875204971F73E50FD265F4AA5CE
SHA1:	36D7302B95C83D124E15465061F4660B46116E5D
SHA-256:	7C316E724F60120CF4F751710B674160F2DFEFEB52CF38FCA5E43B39836D6BC1
SHA-512:	5B509E467E034A7D6D36E214E7A1566BD2DDD49000E8D936C99E7D13768C12B5203C1330F44CB9D879AB3CD5E139167B402DD1BC5DBFC16A18A76E4CDC6314BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d2598d8324b24b88a518e060eacb2acb.IDENTIFIER=geoclue.UNIT=geoclue.service.

/run/systemd/journal/streams/.#9:78591fkqmLP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.328818543792498
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4Ao0iBDVG0hglsa:SbFuFyLVK6g7/+BG+f+M4VVD22jZarvn
MD5:	B0CFEE5A1A43DFBFB42FF87DDD570E47
SHA1:	70775978D9B4D6AB76DB039FC8DF1627C15D3310
SHA-256:	71B13445B33C818965B31E07A8250EE2747C4DB739F7FBCC8D72C310E01A24A3
SHA-512:	32BB93D92BF9C37DE0EC0567AFE0FB5BDABF3ED09F33BB19084E18171A7234010E454FEBA57EA063AA6F00397C29663279B44980FCD8513383065822D5AD840E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e9eb0dd01fe414abdee2eaf8654df0c.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:78593eKSTQM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.407436052741973
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mo8KTxXUjZarvn:qgFqdg7/+0+f+Mo8Iyarvn
MD5:	CB14574704CB906EB7AAC0D35DD2EA12
SHA1:	F8851C5FDACD7D1A3EDD3A78CBDFE888898AA8E8
SHA-256:	745BC755F9323FDF9491DEA0F1E7D9B16D0FFAEB9C5E09C2B2185D81D4CCE3BF
SHA-512:	AD23175F76796832B400D9FB1EBCA7F626B60A51B260A41037552A653FA5A29A28C3F2FA645ADC19DCD4CA2C83DF8E2D8A6A2568349D27F598DB04978FB4A170
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2c8116cef4c4f79a8fb3cc690a1e22b.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:78664csrM0O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.359987480155284
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuqBG1BESZAEtEGU:SbFuFyLVK6g7/+BG+f+MuqwwSZbtEPeo
MD5:	B05FC8EEE35DAB153C5806F8B7D85289
SHA1:	A64B934CF5BD69FD0B84F1B87C58D233375CA6F9
SHA-256:	6525594A0A5DC4A380B4EB5DD507F41F7B39BC59FF5584760E3202F8E3E67DF2
SHA-512:	F4A1EB865474469BB84C2B2D8565594B0762977A65E2B2C7DD0C91F50F4526252200F0CF6E1C5B0ABF8C7F60566BD522060F0B179CA937EA56A25090CBEF54FD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db6cdcdfda764b7abf831899ac6c9d78.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:78666dsywJM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.339688570950954
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm+oqnRJHBHAAEvAi:SbFuFyLVI6g7/+BG+f+M+oC33E0j022v
MD5:	64EA351EAEDEF5B60E8A7E92C3C5CE3F
SHA1:	6BF8F72C7D4744F21DBE84C8284C18028E2DA9F3
SHA-256:	67D91A1D7F3987474FCA3F2619A8AA5F7EC68C626A22029ECF0E8B32FB522BF6
SHA-512:	79D22736D68603B68C9018801FA458173CB130C71AEA34E4A70A3750EA7F817E5BFD00AF8639104D9FFB01649CE0C465633CD61E8D400DCAA7759CCA1E6FDCAA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4f5480afa0ed4377abdb28417929e4ea.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:79001dfluLO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.391750951938104
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo+DdCTQHVAgrqjs3h:SbFuFyLVIg1BG+f+Mo8gs2jXjK
MD5:	C05659D90512E7DEAF216A3266AA6525
SHA1:	425326F60226938FF41EF9B181974D49F7B2FD2E
SHA-256:	03068AB360DD127411C23EE226F3D8C5AC99A436F4D7E69EAB4C78253AFBF901
SHA-512:	5A62159C1F0D9B7A0833BF141AF207A27E6AC839DC5A433623A97E018FE94BEB699B2377142AFB03A12C3ED9B1D9730FFC5E976F73824E42D1F2CD2AA264031A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b94d60f3079c48c688b14b2cf3ea0736.IDENTIFIER=fprintd.UNIT=fprintd.service.

/run/systemd/journal/streams/.#9:79010im6i3M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.382881577039683
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M49A0QavATjJKJMBNr+:qgFq6g10+f+M49ApavABK+NK
MD5:	5A6CD0834312CF43D23DDCA75FA4A893
SHA1:	F2F07F827DAAEFE0109163624C2DFB8A3F470BF5
SHA-256:	94A68DC59AAF8FADAD76F1A71BB4C80200F6F2E2455664DEDC9E723F68A64FEC
SHA-512:	A6313255DC749BE3170611814E6C1CAA23282596049AF40B42925F8502C8D351287B407C56544966D236EF2B0837D5EED658DEF418B9A9E2B94FFD4AB6BC7AAA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a7b2b4fbe7847688606d1a8cb657668.IDENTIFIER=colord.UNIT=colord.service.

/run/systemd/journal/streams/.#9:79013i1HueR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.461768807353636
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm80UFN0HuUsh+sjsiC:SbFuFyLVIg1BG+f+M80UcHuvjZcH5CHq
MD5:	27E400394856273122422A2ADE0343CC
SHA1:	330DF297C0B40D275D5779C5706F221AE05B2E98
SHA-256:	D751A0691309356984D42BE8232C6227A25B5794DA0A8FB18D0E15E2BA38DE87
SHA-512:	16543EA6FE65B2A0C08B112AB650835173336E20307403D5E7AF5CC5F7CC2D6194B792A50D848901B867A972CA7781CEF8A5DCD4E46D889B965E204BE8C20F83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6636d012f4bf4b16af167409cbb35a42.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:79022qom8SO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.430574797761128
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4U2W6xnvsZjhD1DTu:qgFq6g10+f+M4UxMsz9Tu
MD5:	5766B92A7DB30B030BA6310B754577E1
SHA1:	257342C962142D8B4328B9C107270F3A68CC77CE
SHA-256:	35105E379563DDC15DEA56B78DAD3D85A15258D72228E4B57F854F0F831FD2A0
SHA-512:	4A9C0676AD1ADBFB736F96F8D595FB5D64AB3A13C0C05B85E34A7487789E3FA831117FD6D7ACD20D7BAC1DCDE13305655B0B4CA731637FF45D30E60BA2E8BCE6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=271832563e06440f8318bfb0092909dc.IDENTIFIER=ModemManager.UNIT=ModemManager.service.

/run/systemd/seats/.#seat0C0yMeV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Cd6YKm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0OCqCVx

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Qyx7Gk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0RAc34j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0RRnGgj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0adRrtk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0ilwM0j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0xPk9tl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c1C9o9ql

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4195264143775885
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GB60Jg3Q02IRS:qgFqPumW8IG0n99x2xayW5g3QD
MD5:	C358D48004A1AFB9D33C01FA267B6148
SHA1:	88C091618407B90E56470D992E4AC4F5E479AC55
SHA-256:	B26F69714FCB038325BD4740DFA43EED42051081CEE55A31DDF0685174C85743
SHA-512:	E199FDF99369AE8FEE0E177BF1358CB71DE78AFD61A0E83A4889C2EAEF6B1997FFCDACE7849BFFE899CB2E5FCB30CBB81A6C22AC477643A0B38D7B590C03402A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c1CXir0k

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.435803363433101
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB60Jg3Q02IRo+n:qgFqPuFN6IG0n99x2xayW5g3Qb+
MD5:	28AAEB04FAFB6E84D480E3F6EC2F1D63
SHA1:	FDEB0BE1348B7955BA56C1475935464BF11A3756
SHA-256:	C4415F3881898B55047168154D42AAA417D8EB18C908F0D5672DDA4024D30708
SHA-512:	91DBD3FCA4ADEFE34760D5FA68696A3D65C3C9928949B41763BDF123C715D19E3F48A4687DE4BDD625B18639A29343AE07E32752B5E12D572DA145B21AAF748B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.CONTROLLER=:1.9.

/run/systemd/sessions/.#c1RSM9dm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420355384263436
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB60Jg3Q02IRS:qgFqPuFN6IG0n99x2xayW5g3QD
MD5:	D26F3A7315E1C50448FDB8B7CA198D5E
SHA1:	01BEADC599AAA1874CDE1CA56A7A75CFC119E9E3
SHA-256:	2DE17D38BE0904F49325D81235969A494F2557C220959F31EDB455B903277656
SHA-512:	78157C1B2C9E1911CAC169E64E36A5656661FA2DA0C536747634472DE7706ADF79933EAAE6FF052B3BB9126BA76C47B849D72553DC3B8B9D2B92F7226CAB02B9
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c1T09tXl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.486603696299185
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xff4DWvExHxfx2xNIByy6GB60Jg3Q02IRS:qgFqPumVuRZI4BADWvExH9x2xayW5g3k
MD5:	1646D276CEFE536D1BAFA469BF4BC44B
SHA1:	CADB2285B7F7B821BCE5BA28ACE0C58E0C74294B
SHA-256:	2758C622C14D8671EB521A16D2C68DD2C08D198AC35D17661472D980FA86B6E9
SHA-512:	217F8AF5CA679C00D2219CC06163ABE609DEB17219B5A2511630B1B457428CFB9BF5FFCCD1DF8247E4A9A856F89F1C2703A2C3C5829FD688AF5E3651A49754B8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/10533.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c1mcI7tk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.377327748963445
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GB60Jg3Q02IRS:qgFqPuFdDJIi9x2xayW5g3QD
MD5:	2C999C4FE26588830AB9097FEF92423F
SHA1:	9AECFFD32C5A5BE14CF1E5519521EEA1E633EB18
SHA-256:	990ABC932415CD742536658531F2B37077AF2E4E5DB63C2A0404E8728B55CDD0
SHA-512:	19F3C5240296FD5F83FC6185BB3981B91FC02EDC08C4D70B292920DC308C78041547CBD79746D3982A163E0A2A8CB6D02419D9F8FBF9F357CC79F9E4C04CC745
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c1ptiNKl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4195264143775885
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GB60Jg3Q02IRS:qgFqPumW8IG0n99x2xayW5g3QD
MD5:	C358D48004A1AFB9D33C01FA267B6148
SHA1:	88C091618407B90E56470D992E4AC4F5E479AC55
SHA-256:	B26F69714FCB038325BD4740DFA43EED42051081CEE55A31DDF0685174C85743
SHA-512:	E199FDF99369AE8FEE0E177BF1358CB71DE78AFD61A0E83A4889C2EAEF6B1997FFCDACE7849BFFE899CB2E5FCB30CBB81A6C22AC477643A0B38D7B590C03402A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c1wIBXAi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420355384263436
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GB60Jg3Q02IRS:qgFqPuFN6IG0n99x2xayW5g3QD
MD5:	D26F3A7315E1C50448FDB8B7CA198D5E
SHA1:	01BEADC599AAA1874CDE1CA56A7A75CFC119E9E3
SHA-256:	2DE17D38BE0904F49325D81235969A494F2557C220959F31EDB455B903277656
SHA-512:	78157C1B2C9E1911CAC169E64E36A5656661FA2DA0C536747634472DE7706ADF79933EAAE6FF052B3BB9126BA76C47B849D72553DC3B8B9D2B92F7226CAB02B9
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6264.REALTIME=1718528010169704.MONOTONIC=187432800.

/run/systemd/sessions/.#c214ovRl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.44065865907831
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0SqmkMT3:qgFqPuFNuCH0nI9x2xayWwTg3QkmkMT3
MD5:	BEB008EC847D5C0D1C41E71DDFBD57E7
SHA1:	CFA3F9A2F324F7D188359B57A2993C6611022F13
SHA-256:	CAC50FD34B8BF78B69513116F3C9859D469FEA8A78EEA552913B8FE33803A6B4
SHA-512:	69012F64CD2A55521E49831AFF96ADD0A4A16EB4EFA08F783D678664D0D4F77C879A78F288EDEF153FD438E74A81F48898DDA40E7532EE8433B363A4E1D8C3ED
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.CONTROLLER=:1.13.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c21PWCRm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.417058705443451
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0Sqn:qgFqPuFNuCH0nI9x2xayWwTg3Qkn
MD5:	7B108492AA695D2852BFC7E1E445BCD0
SHA1:	D69EF159A0256116419B9715A03A8CCB92E347CB
SHA-256:	E461528C56609B9335713715559FF20D9F4D9B42AD4BF92A15EA75EFCFAE3055
SHA-512:	5FFB661C2FA9D5A478DABCF75330B80424E53CE23055555BE476A7EAA9B48244FE8C3B3A0DB2BF544D862D872A1A56F92BD3DAFF44A4ABB3736BA68158078425
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.

/run/systemd/sessions/.#c287JqWj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.428631858701927
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0SqmkMi:qgFqPuFNuCH0nI9x2xayWwTg3QkmkMi
MD5:	34D8F8605BD67B7BABA9A0395EF52FFC
SHA1:	8173130A9988632509F60BAF43BFFD7B63D482ED
SHA-256:	BF7F0F9E3B83234DE56196614C87F69D0F6BE48A089657C3E10AF5385C5F2A42
SHA-512:	D63735642DB88BB41FBCD29BF289C4BAE54063DD1E9D491F4DD3CD357F184179A1649E0811AC5EC04182D7FE45ADA24446D2BB622CF9B0AB7F1A426AC940941E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.CONTROLLER=:1.13.DEVICES=13:64 .

/run/systemd/sessions/.#c2BmQHVl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.447223354595955
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0SqmkMns:qgFqPuFNuCH0nI9x2xayWwTg3QkmkMns
MD5:	2C34ACFD9BF7E4F18EFEE1BAAD271301
SHA1:	910FFA989CAF9DD10578A00B8A4F50F598F2D637
SHA-256:	1DF918F5C989AF2602138EF248D5762638F469839B498FE7F572FC4F25699770
SHA-512:	BA1DA6CCA51E1362DFC73D023414520D67D6A6CB998F6218AC4424E059EC871E18E7CCD7757E46DB0167C51BE5228DA225F44CC7A7D092B1D89D848A0656D4AC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.CONTROLLER=:1.13.DEVICES=13:64 13:65 13:67 .

/run/systemd/sessions/.#c2SYjnHk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.446397915346365
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0SqmkMnS:qgFqPuFNuCH0nI9x2xayWwTg3QkmkMnS
MD5:	566C7252A9F03207F3E58A1B13986D63
SHA1:	4CA4FE1347DEE94688A21ACF8D0D120544E0E4F1
SHA-256:	FF24393E50618615591BE4FFB39003674D2EE7B5F405F6F2AF8D33501A66B469
SHA-512:	A2ACB400C56845824D15642BBDEB68329DC083299342F52509FD7521B01C699DB6F18C6E9BCFB1433A5FD282A13F2C1ACC877F98D87EAA365A9F01680F64FE12
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.CONTROLLER=:1.13.DEVICES=13:64 13:65 13:66 13:67 .

/run/systemd/sessions/.#c2Y7Vklm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.47360080854181
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xff4J7kBxfx2xNIByy6GBCNxJg3Q0Sqn:qgFqPuFVuRpCvBAJ89x2xayWwTg3Qkn
MD5:	7C5872B0235AEB778913B638F1998A7D
SHA1:	22136D0B54716FC636A3884AA3868EAAF109C1B2
SHA-256:	203FCD849B5E7BF7B0CCC7C67DA2C51298A2C5782271F1B43BB244FA6489F544
SHA-512:	F18918343481F162AE3E3113904B2E3CFA322905E7F5FDBF17135685131CF9E9B7048D65477341F3738750E7CC88AC02AF9A267C52BAC7B3FAA1A92CABDEE4FF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/10596.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.

/run/systemd/sessions/.#c2mCrwXl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.425223027620149
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0SqmkH:qgFqPuFNuCH0nI9x2xayWwTg3QkmkH
MD5:	B9D846D2BDEE06B777A9572DAC027F3C
SHA1:	952A0A3EFCE4D3C9DC7CAF8310A70968BDB72A73
SHA-256:	6D80F4015384091DC100C4DBCB1CCD251B537F9FB796B448229812A5F67C8BA1
SHA-512:	A9F1A3A9222832CA23B6BA8104A6EC35F80C911DB012EC06A47D59BF65258C86C58BEAAEECBBF12BFB1DB6CB60A46ACA5421A6AF309824ABB30C78411CEFB64B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.CONTROLLER=:1.13.

/run/systemd/sessions/.#c2rMWy7l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.417058705443451
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBCNxJg3Q0Sqn:qgFqPuFNuCH0nI9x2xayWwTg3Qkn
MD5:	7B108492AA695D2852BFC7E1E445BCD0
SHA1:	D69EF159A0256116419B9715A03A8CCB92E347CB
SHA-256:	E461528C56609B9335713715559FF20D9F4D9B42AD4BF92A15EA75EFCFAE3055
SHA-512:	5FFB661C2FA9D5A478DABCF75330B80424E53CE23055555BE476A7EAA9B48244FE8C3B3A0DB2BF544D862D872A1A56F92BD3DAFF44A4ABB3736BA68158078425
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=6304.REALTIME=1718528018968320.MONOTONIC=196231416.

/run/systemd/users/.#1273bKWwj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.182505265569801
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTg3Q0cRXh2z5c2zw02zb2owB:qgFq30z1cL/ixxTg3Qgz5HzwPzbA
MD5:	FB087605958B52266AA31B39D5A23C5C
SHA1:	E1577B3F389695E43644636033D7AE88A8A12A6D
SHA-256:	85D89E6BFF3DB9DBC8E30ACCE1A965C34068D93F6616CBA55A6360381AF3DDEF
SHA-512:	F6C374E90C2A83939A0C0C793A617263F4FACA154F6253151F4BBC37281F6D0B310893A66EB132493F6346047E82BDB0F131DF20EC0C6719C5577245E065A148
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1274boXnk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2913181041500055
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff417g3Q0cRXh2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBA17g3QgthQHtPYq9M
MD5:	93A21C44A00C3134985AAB1EB864FFEB
SHA1:	91CBD4EBD35B9ABADE3E7A7AE604453DF9680359
SHA-256:	E126D42CA474461A35A08873904D3AD79D986BEA85E9A1839296AC87FF221072
SHA-512:	06959FF6BF579E1D4BD15491164A45A3EE87CE1DCB79681C9C751EF705497E7EB45916D6E7D170404EDDF2827AA3477C87C87EF1D1D29228560932CE69D874C5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/10471.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127E7HOSl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127G34iml

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1553622018554295
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfg3Q0cRXh2thQc2x9sS02/g2owB:qgFq30NzL/ixeg3QgthQHxbPYA
MD5:	0F800DE2D1998854087B82C12B7E1F01
SHA1:	DA572A4926ED0B06E5E11358500324A12E2350C9
SHA-256:	0ADFCF3CAA33DCCF213FB6A949E44A2CB6C61807EF50404E9ED23843BB7A4976
SHA-512:	0E0D19CF7074232ECC0C68EF6078DBD6390229F54529174C1C4298C229C794412EC2AE6536C7CFF8A8D8D374D82CAE341EA86DCCD579231AE915DE8F405E5950
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127OmhCik

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.175094671754497
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg3Q0cRXh2thQc2x9sS02nmD2owC:qgFq30dAL/ixeg3QgthQHxbPnmDd
MD5:	4437DCB3EFFA9B7876ECCCC27EA88D24
SHA1:	C9AF39E249638893D823CB085D21E8FEF5FD8FBC
SHA-256:	F7857F996F04FA3AF766992C76A24E95FEE92ACBC4AEEE26804BD4806BBC989D
SHA-512:	D020AC21D32A1E693F96A8E56B8914D25DFC12702E8BA30F23085710CC1F879500732185BA08A1B0F604241E4C143E6C984AFB450173C834251D67A071FC30BD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127Yxxhvk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.165569085381769
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfg3Q0cRXh2thQc2pb02/g2p9rwB:qgFq30z1cL/ixeg3QgthQHtPYq9M
MD5:	A8E1A6E7CDE3BC1CBE28AF932B71C0BF
SHA1:	4D2E7C0E49F9D25985A26208738BE2EC11880F01
SHA-256:	52ABAEA54CA6901426EEBFA716F45988A79FCC4FE38F3632ABA37DF33CDD92CE
SHA-512:	A5DC8CF14196171DF832F71D6084FAF852703F507C7BBE01BDCF5D1E1B2B09820F4F040229CECE63E563652D79A258BE706CE12DECD31A8B5451CC3ED833C20E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Z8cAyj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.16400726935129
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg3Q0cRXh2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg3QgthQHtPnmDq9x
MD5:	7F0A3D4DDBDF54852B0C296B5D8344CF
SHA1:	9EBD99ABDD51C67AE93E115494BC77C3595D8AE9
SHA-256:	E0A093899107A7248649C039BFC2BE9B7267200AFBE5636C3462E9A19E609E71
SHA-512:	8AE52E198ACD91C8DD6EB8D3339C0201E01112F685ED22CC223A478449CA7CE66B86818258BC238DC41C4A6BEC58F3D4855FB96C9863BBA5624367AFB2167EC6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127iEtCWj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.16656901058972
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTg3Q0cRXh2z5c2zw02zb2owB:qgFq30NzL/ixxTg3Qgz5HzwPzbA
MD5:	A10F97476B47A909395278F53DF035CF
SHA1:	D50C85DCEDFE9C1EEFD7991EA8CDC7FD100B51A9
SHA-256:	43D08E1F3C365BF4BD0BE70D94A1EFDB5124B9F577D1A72E597DD5ABF09E9DC8
SHA-512:	EA3F563DD13761BCF8D0BCCEC4AEB2FCAB7465C6FD367929CD9A4421E3E2414BE97AA59C40F6386D42A734FB0ED0C28573273699ACA394F29FCA46CC263FD899
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127kTgVQj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.16400726935129
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfg3Q0cRXh2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg3QgthQHtPnmDq9x
MD5:	7F0A3D4DDBDF54852B0C296B5D8344CF
SHA1:	9EBD99ABDD51C67AE93E115494BC77C3595D8AE9
SHA-256:	E0A093899107A7248649C039BFC2BE9B7267200AFBE5636C3462E9A19E609E71
SHA-512:	8AE52E198ACD91C8DD6EB8D3339C0201E01112F685ED22CC223A478449CA7CE66B86818258BC238DC41C4A6BEC58F3D4855FB96C9863BBA5624367AFB2167EC6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127pB1hHl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.311123989636971
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff4jufg3Q0cRXh2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBAeg3QgthQHtPYq9M
MD5:	11A657202875C947137CD50191739CE8
SHA1:	B9349ED647A6E0083453588C519617C3C7CAAD1F
SHA-256:	5DD457B9CF634C42761716BF4F603DB82F314D717D4C6F8B36DBEBBAB9736DEF
SHA-512:	2C6A6882786268F3C47D8A64C7DAE9CE382D7EA6ECE2273C880269E622BA84801EEACB781E3F724A07FC956011D0C32D398F3CC7C302089938ABDC1573F309B0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/10471.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pKSV3j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.160710852532158
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJg3Q0cRXh2z5c2zw02zb2owB:qgFq30z1cL/iRJg3Qgz5HzwPzbA
MD5:	A056F4D96B294EFF98240E418C82C9F5
SHA1:	C7955A5EFF2B672DAB06578FBEF82C369D4A9B47
SHA-256:	0C2ED47093F2EA6FF8A6FED7658E118E056C45F54F5F7DD5DD18DC08B8A1B3D3
SHA-512:	9292E43864B28E121B738E2B5A518D52A1EE918942492D6D40B9D36D9A80791F722B4ECAE299D3B9A20F4EFE444BB61886A2EE2E9332F45D90D0D14E20825A8B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127wqq3Mj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.165569085381769
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfg3Q0cRXh2thQc2pb02/g2p9rwB:qgFq30z1cL/ixeg3QgthQHtPYq9M
MD5:	A8E1A6E7CDE3BC1CBE28AF932B71C0BF
SHA1:	4D2E7C0E49F9D25985A26208738BE2EC11880F01
SHA-256:	52ABAEA54CA6901426EEBFA716F45988A79FCC4FE38F3632ABA37DF33CDD92CE
SHA-512:	A5DC8CF14196171DF832F71D6084FAF852703F507C7BBE01BDCF5D1E1B2B09820F4F040229CECE63E563652D79A258BE706CE12DECD31A8B5451CC3ED833C20E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1718528010160353.MONOTONIC=187423449.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:XJ:Z
MD5:	D8169F743E369A84896B3469403FFA05
SHA1:	E9C97F78A6FE80BDB4E559111022D8A3088C505F
SHA-256:	8EBCD6A0B681E34192CA8EE739EEAE295459A60EE424C0F53557E7C474857D0A
SHA-512:	D7DC879ED7B571AAEAF89F0827E82EFF989A17FE321AE46583767D24B60401B9A4A903EE63B0DE375AE0BD84856A00E9864147F95F34EC4BADE6E7A491190C32
Malicious:	false
Preview:	6394.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.985516981316825
Encrypted:	false
SSDEEP:	12:OxPGntEIOveY+GniPNvxPyTY22veY+yTYGxPDQXwveY+D44xPUBKiveY+U3BQZ0U:NtEIMnMKXIr86BPav1k+12Jd7Lox
MD5:	F746F75DFF8909156F605AB38A1A2BE7
SHA1:	C1E3C52BBC7611FD4807C409BA0D7BEB7BECD1AA
SHA-256:	65FA1B9E9912B1154CC97C22D8FF40DC66E24855B17F268C40B4A0CBC25DE031
SHA-512:	61FF275E3259F323FDD4BF2F52BCF899A1E32E1F6FE32BD5320590BE93167EA7B7A7242EDC58CCDB88A1A85AC08673F4E885FB4AECF68D029E740D7F17FFC3C1
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/6329..MIT-MAGIC-COOKIE-1....-....%Lu.e......XSMP...#local/galassia:@/tmp/.ICE-unix/6329..MIT-MAGIC-COOKIE-1...uI...FF.E.*......ICE...!unix/galassia:/tmp/.ICE-unix/6276..MIT-MAGIC-COOKIE-1....Bb.b..p..^1....ICE...#local/galassia:@/tmp/.ICE-unix/6276..MIT-MAGIC-COOKIE-1..a...zx....QP<.D3..XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.882427239163555
Encrypted:	false
SSDEEP:	3:rg/WFllasO93Gjm3TqVutCgWFllasO93Gjm3Tqu:rg/WFl25j+utCgWFl25jb
MD5:	B4F8A910C4B80F947995D2CF339A0120
SHA1:	FD1C7B3EC2DF236DA4343D84762497BD91A7D39F
SHA-256:	E194A0B41F00DF7B2B977D2D19F28B359A54323470EB63EA1A33899E94321363
SHA-512:	9777D08516FE6CE50BFA32168941D2E5A0AAD457AE7421A70C18168A67E6E13F10494406F9CF85649CF64294AF027A1D67D01963AB964EBA5D9D61FE9298658B
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1....XKJek.....i.xI....galassia....MIT-MAGIC-COOKIE-1....XKJek.....i.xI

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:a:a
MD5:	02E2A964439F68C0AE1BD0E0EB146949
SHA1:	C2157E0243E79363E4D6EA4DF2F4DD55445BD26B
SHA-256:	F72D9BA79B9F629EAB8B4A203DBC8F51B86F673657141EB843A189E4C265D644
SHA-512:	2AE42B09050CE076002BB36C5B30799C5E692FC4545547789511339281C10A7E7824C2C0AF5D1062C5BDA381985259D35523BCAA3452A9CBB8F276B0798ADA6F
Malicious:	false
Preview:	6607.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:1RSsXlXEWtl/ar+gv:7+yly
MD5:	A306DAC8FBB2DBAC26FD8DF7EC61DB76
SHA1:	891FD58DD6591DFD14527192D6C4E6C4A03B6B5A
SHA-256:	066477B386344F61BD6283A33469ED35E5E8C66147AA37527F19624D58F09676
SHA-512:	90C7BB192D35A48673A39F207FEBC92B55C2CFE8882FF5A42436A737CFFCD09EA640E6DE482CE9F735CA433053234281E6C5E6772BC1C61112CA4D03C074785D
Malicious:	false
Preview:	....j...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................j.....nf,.......................................

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.EGXGP2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.R49VO2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.103372518034259
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWfP6nGT0p1P:q5sU3LWfLUDmQymqSFbfomS8GTAfN
MD5:	D664841627BFD903525A0E59ABFD737D
SHA1:	AA563532E44E3AC9120E480FCA638AE78F52F53A
SHA-256:	98A6390068ABDBB055B0DCD716F2AB44363EF694E4F2E2607F95534C6E61EC25
SHA-512:	88DB169BFEB810B73F3EC0CCEFA64A7BED334EF8810E1B2A6EB5734332646C297ABCA05298C5A1DA236C3810B53B267042F0CD749DCF09A5425F91E7CD58A0B6
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-xoT3loq9,guid=a49e7f334dc6d58a15aaac8c666ea839.IBUS_DAEMON_PID=6480.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.281721915936508
Encrypted:	false
SSDEEP:	384:MynWti05wMed+dgd4d8dBdid2d/dmd+dZdKed9d7dhdfdadSdddCdzFdHgdT8dtm:1nWAgHuNxZI5YnAOnhNqbG
MD5:	80E23C56A609F4A40C0DC4F202C48BCA
SHA1:	F1BD830340514096DDD0F1D3AF663C0E64DF02DA
SHA-256:	4174CD6DC6C4952258261237A7423EAB9CD7CCB58024DB3CE6DE9C0C5CEC82FD
SHA-512:	87DEB587249C4220C29889BDCD3B99195A4E9D3C04E3273902C7BEFBA9ABA880E8B17742A1174A8C1C1E4839A8852F89C14D155CB67EB98869776584B272DB8F
Malicious:	false
Preview:	[ 197.116] (--) Log file renamed from "/var/log/Xorg.pid-6311.log" to "/var/log/Xorg.0.log".[ 197.134] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 197.144] Build Operating System: linux Ubuntu.[ 197.149] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 197.155] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 197.168] Build Date: 06 July 2021 10:17:51AM.[ 197.172] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 197.176] Current version of pixman: 0.38.4.[ 197.180] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 197.184] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.886287110535578
Encrypted:	false
SSDEEP:	12:BFhS9KxfF4tFaA1FsZPgKGecFsZPaV5pGecFV4kecFVA8FVAXFXMSvFdAvmVFdAD:Z/xqtFdoZ4EZeTrZh57AvuA2+V97
MD5:	665776C7286C1480DD92CC057FEDCE45
SHA1:	8BF475BD7E3CDA1E1DB6B8276E481DAF75793FB4
SHA-256:	C9A7927F9EE3064CCD9E770C7985D968E3B543020893B3ED035B878FC0E4190D
SHA-512:	BEAA31A82D7958B652D6FC89E9264CD734A4B3E738FD8F4768A82F6D48A77062D1ED8A414171DD10E77F714BF0608E0278582989DD07598B69510029F3D59438
Malicious:	false
Preview:	Jun 16 03:52:36 galassia systemd-logind[801]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Jun 16 03:52:36 galassia systemd-logind[801]: Session c2 logged out. Waiting for processes to exit..Jun 16 03:52:38 galassia systemd-logind[5599]: Failed to add user by file name 127, ignoring: Invalid argument.Jun 16 03:52:38 galassia systemd-logind[5599]: Failed to add user by file name 1000, ignoring: Invalid argument.Jun 16 03:52:38 galassia systemd-logind[5599]: User enumeration failed: Invalid argument.Jun 16 03:52:38 galassia systemd-logind[5599]: User of session c2 not known..Jun 16 03:52:38 galassia systemd-logind[5599]: User of session 2 not known..Jun 16 03:52:38 galassia systemd-logind[5599]: Session enumeration failed: No such file or directory.Jun 16 03:52:39 galassia systemd-logind[5599]: Watching system buttons on /dev/input/event0 (Power Button).Jun 16 03:52:39 galassia systemd-logind[5599]: Watching system buttons on /dev/input/event1 (AT Transl

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hlfcn8Yull/Xcn8Yell:F3PcnJevcnJO
MD5:	8FCDB9C1294D174D0F2CB140AAA9685C
SHA1:	CBC7B2DAC90DB990E8BA8C750FCF91C4F21B88F3
SHA-256:	95311C8785B3E6029530A89E0B417AE9A0E4336924FD0D9A09DE3C8F9520233D
SHA-512:	937B2CCC450FFFFDFEE25A7F12805A7F2E632E9A6BEAD1CEC90A9EBF574498432F3AE1AEF8D1DECB78BC6AB0F83DF250C4BFB2836CE8EB9BADD5F554F4B93837
Malicious:	false
Preview:	LPKSHHRH...................y..J....=......................................y..J....=...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlUpkypc:F3OZc
MD5:	E38B09297512192820913748F41BDD36
SHA1:	DACCA2CC6B1F2EFA9FEA629BA2C5AB7EBC7BF0DF
SHA-256:	5A03DF8C1C95B8AD6A308DBD2C0B96D8890E93B2E6FB84B7073353DD431010EF
SHA-512:	7043E5B17C3C880073FDA1FC79C39A0BF61511B81BA9E99D437F3C353BE0E954F9DD46B5872BF66E0E4F02AE5129A936AD573E9389DFC73751B056E187C87A47
Malicious:	false
Preview:	LPKSHHRH.................m.e..E...Y.H..................................m.e..E...Y.H.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5848
Entropy (8bit):	4.665068302191726
Encrypted:	false
SSDEEP:	48:N4A7osQn71GuKaf/gseJv+I7UnURea+Hz7jiH9dGPred5UvZPt3aFrszFrXBXZFt:5tB4kQ2Lw
MD5:	7F2BB6BD2E886482CC524F54CBB56A7E
SHA1:	497141F06CB33B609073CFBA859E51867445D98B
SHA-256:	4C42EF6CCCC43CC552AE1526F476FD6D0A4DA1EB577B310869B3D29F0C6876EB
SHA-512:	521A290BEECCAD25C54EC3C9018C4C786813E8AEE1783F0D265DE3B62B8B729BF6A8E7C8306BEDAD2A7D713D8C6F415FD8762BBF1EB3A515E3FCBC568B196521
Malicious:	false
Preview:	Jun 16 03:52:55 galassia kernel: [ 152.445671] blocking signal 9: 5544 -> 3157.Jun 16 03:52:55 galassia kernel: [ 152.620700] blocking signal 9: 5544 -> 661.Jun 16 03:52:55 galassia kernel: [ 152.644245] blocking signal 9: 5544 -> 725.Jun 16 03:52:55 galassia kernel: [ 152.662534] blocking signal 9: 5544 -> 780.Jun 16 03:52:55 galassia kernel: [ 152.681126] blocking signal 9: 5544 -> 940.Jun 16 03:52:55 galassia kernel: [ 152.706049] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.721398] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.750336] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.876728] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.892941] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.908967] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.923943] blocking signal 9: 5544 -> 1300.Jun 16 03:52:55 galassia kernel: [ 152.9409

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	8171
Entropy (8bit):	4.872481009252298
Encrypted:	false
SSDEEP:	48:N4A74uz3x4SA49x4x4a2Xh8PtXdGRVosQn71GuKaf/gseJv+I7UnURea+jQpkS9R:0IseRztBaQg7+UiQ2Lm2
MD5:	6450CA01F6F44DEEDF10DBA75EB5E70C
SHA1:	1997232B5AE407D99EB6A12252187A221069150F
SHA-256:	5419944DB4CABC20EECF1998D01F87E5EAD7CC1A7BF6EFEB16D49169764542FD
SHA-512:	97B0886474B2B68C72517DFD1948F164D9E8DDF7BDE3A50250AC2B3AC8496D8C5EF95905D4A1C706F0A1F26EC29A04CECEFAF5C014F9C1A7882402FB61B2F62B
Malicious:	false
Preview:	Jun 16 03:52:55 galassia kernel: [ 152.445671] blocking signal 9: 5544 -> 3157.Jun 16 03:52:55 galassia kernel: [ 152.469765] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jun 16 03:52:55 galassia kernel: [ 152.469831] systemd[1]: rsyslog.service: Failed with result 'signal'..Jun 16 03:52:55 galassia kernel: [ 152.489778] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Jun 16 03:52:55 galassia kernel: [ 152.489782] systemd[1]: dbus.service: Failed with result 'signal'..Jun 16 03:52:55 galassia kernel: [ 152.491414] systemd[1]: Started D-Bus System Message Bus..Jun 16 03:52:55 galassia kernel: [ 152.585383] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 8..Jun 16 03:52:55 galassia kernel: [ 152.585398] systemd[1]: Stopped System Logging Service..Jun 16 03:52:55 galassia kernel: [ 152.586106] systemd[1]: Starting System Logging Service....Jun 16 03:52:55 galassia kernel: [ 152.620700] blocking s

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:1RSsXlXEWtl/ar+gv:7+yly
MD5:	A306DAC8FBB2DBAC26FD8DF7EC61DB76
SHA1:	891FD58DD6591DFD14527192D6C4E6C4A03B6B5A
SHA-256:	066477B386344F61BD6283A33469ED35E5E8C66147AA37527F19624D58F09676
SHA-512:	90C7BB192D35A48673A39F207FEBC92B55C2CFE8882FF5A42436A737CFFCD09EA640E6DE482CE9F735CA433053234281E6C5E6772BC1C61112CA4D03C074785D
Malicious:	true
Preview:	....j...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................j.....nf,.......................................

Source: 78O7BJ6Qg2.elf	ReversingLabs: Detection: 60%
Source: 78O7BJ6Qg2.elf	Virustotal: Detection: 43%			Perma Link

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.011427193526558
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	78O7BJ6Qg2.elf
File size:	128'748 bytes
MD5:	f071aa45759ace7eaa49446f9629e0f5
SHA1:	cf7af720e736b6d66c4e28278dbba2a38931b31a
SHA256:	eeeb3abb1dc4f7439ea12706fd5879ea4e25ee356b6c000eed646b21a18d0d37
SHA512:	2eaf9e401748f38df3502632cffc080bb27a1023917c0985a73d37d3f23fbd033a59d393b5711f3428a56d27c0fe252864336b072ed230b4ba58577141bcc2fa
SSDEEP:	3072:YZAAwCCb7NYUoGAa9uYdEVBje9fb71GZnskrV6Xm:YZHwCCbZDL/oYdMUV8Th62
TLSH:	1FC36CC1F243C4F5E85605716036EB378B32E1BE1129DA57D3B99F32ECB1502DA1AA9C
File Content Preview:	.ELF....................d...4...\.......4. ...(..............................................=...=...G..............Q.td............................U..S............h.....y..[]...$.............U......= ....t..5.....=......=......u........t....h.-..........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	128348
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x179a6	0x0	0x6	AX	16
.fini	PROGBITS	0x805fa56	0x17a56	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805fa80	0x17a80	0x3313	0x0	0x2	A	32
.ctors	PROGBITS	0x8063d98	0x1ad98	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8063da4	0x1ada4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8063dc0	0x1adc0	0x475c	0x0	0x3	WA	32
.bss	NOBITS	0x8068520	0x1f51c	0x4a2c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1f51c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1ad93	0x1ad93	6.5958	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1ad98	0x8063d98	0x8063d98	0x4784	0x91b4	0.3789	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 16, 2024 10:52:42.472470045 CEST	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable
Jun 16, 2024 10:54:02.486713886 CEST	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable

Start time (UTC):	08:52:33
Start date (UTC):	16/06/2024
Path:	/tmp/78O7BJ6Qg2.elf
Arguments:	/tmp/78O7BJ6Qg2.elf
File size:	128748 bytes
MD5 hash:	f071aa45759ace7eaa49446f9629e0f5

Start time (UTC):	08:52:34
Start date (UTC):	16/06/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	08:52:36
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:38
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:39
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:40
Start date (UTC):	16/06/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	08:52:41
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:42
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:43
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:48
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:44
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:45
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:52:46
Start date (UTC):	16/06/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	08:52:47
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 78O7BJ6Qg2.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6280/oom_score_adj

/proc/6283/oom_score_adj

/proc/6285/oom_score_adj

/proc/6287/oom_score_adj

/proc/6289/oom_score_adj

/proc/6291/oom_score_adj

/proc/6294/oom_score_adj

/proc/6344/oom_score_adj

/proc/6371/oom_score_adj

/proc/6374/oom_score_adj

/proc/6376/oom_score_adj

/proc/6378/oom_score_adj

/proc/6380/oom_score_adj

/proc/6382/oom_score_adj

/proc/6385/oom_score_adj

/proc/6559/oom_score_adj

/proc/6720/oom_score_adj

/proc/6736/oom_score_adj

/proc/6930/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1p7XkJj

/run/systemd/inhibit/.#25IS4Mk

/run/systemd/inhibit/.#32oOf7m

Linux Analysis Report
78O7BJ6Qg2.elf

Start time (UTC):	08:52:51
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:52
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:53
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:52:54
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:55
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:56
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:52:57
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:58
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:52:59
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:53:02
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75