Edit tour

Linux Analysis Report
X2Yb9u8Ntz.elf

Overview

General Information

Sample name:	X2Yb9u8Ntz.elf renamed because original name is a hash value
Original sample name:	57f7cd76662180c940fa3e47c9c53f1a.elf
Analysis ID:	1471733
MD5:	57f7cd76662180c940fa3e47c9c53f1a
SHA1:	611feca3bee73372356b7be8c66265e0a0ddee36
SHA256:	20d61bf0abe931d3945947b09e1111b0b246000d7bb73535347cc2e3f04f8546
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1471733
Start date and time:	2024-07-11 21:14:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	X2Yb9u8Ntz.elf renamed because original name is a hash value
Original Sample Name:	57f7cd76662180c940fa3e47c9c53f1a.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/160@12/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: X2Yb9u8Ntz.elf

Process Tree

system is lnxubuntu20

X2Yb9u8Ntz.elf (PID: 6273, Parent: 6195, MD5: 57f7cd76662180c940fa3e47c9c53f1a) Arguments: /tmp/X2Yb9u8Ntz.elf

X2Yb9u8Ntz.elf New Fork (PID: 6274, Parent: 6273)

X2Yb9u8Ntz.elf New Fork (PID: 6275, Parent: 6273)

X2Yb9u8Ntz.elf New Fork (PID: 6276, Parent: 6273)

X2Yb9u8Ntz.elf New Fork (PID: 6277, Parent: 6276)

X2Yb9u8Ntz.elf New Fork (PID: 6278, Parent: 6276)

X2Yb9u8Ntz.elf New Fork (PID: 6279, Parent: 6276)

systemd New Fork (PID: 6293, Parent: 1)

journalctl (PID: 6293, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6307, Parent: 1)

systemd-journald (PID: 6307, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6309, Parent: 1)

journalctl (PID: 6309, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6352, Parent: 1)

dbus-daemon (PID: 6352, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6353, Parent: 1860)

pulseaudio (PID: 6353, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6358, Parent: 1)

rtkit-daemon (PID: 6358, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6361, Parent: 1)

systemd-logind (PID: 6361, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6423, Parent: 1)

polkitd (PID: 6423, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6428, Parent: 1)

agetty (PID: 6428, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6429, Parent: 1320)

Default (PID: 6429, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6430, Parent: 1320)

Default (PID: 6430, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6431, Parent: 1320)

Default (PID: 6431, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6433, Parent: 1)

rsyslogd (PID: 6433, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6434, Parent: 1)

gpu-manager (PID: 6434, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6435, Parent: 6434)

sh (PID: 6435, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6436, Parent: 6435)

grep (PID: 6436, Parent: 6435, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6440, Parent: 6434)

sh (PID: 6440, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6441, Parent: 6440)

grep (PID: 6441, Parent: 6440, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6442, Parent: 6434)

sh (PID: 6442, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6443, Parent: 6442)

grep (PID: 6443, Parent: 6442, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6446, Parent: 6434)

sh (PID: 6446, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6447, Parent: 6446)

grep (PID: 6447, Parent: 6446, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6448, Parent: 6434)

sh (PID: 6448, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6449, Parent: 6448)

grep (PID: 6449, Parent: 6448, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6450, Parent: 6434)

sh (PID: 6450, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6451, Parent: 6450)

grep (PID: 6451, Parent: 6450, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6453, Parent: 6434)

sh (PID: 6453, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6454, Parent: 6453)

grep (PID: 6454, Parent: 6453, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6455, Parent: 6434)

sh (PID: 6455, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6456, Parent: 6455)

grep (PID: 6456, Parent: 6455, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6459, Parent: 1)

generate-config (PID: 6459, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6470, Parent: 6459)

pkill (PID: 6470, Parent: 6459, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6477, Parent: 1)

gdm-wait-for-drm (PID: 6477, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6487, Parent: 1)

gdm3 (PID: 6487, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6491, Parent: 6487)

plymouth (PID: 6491, Parent: 6487, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6508, Parent: 6487)

gdm-session-worker (PID: 6508, Parent: 6487, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6512, Parent: 6508)

gdm-wayland-session (PID: 6512, Parent: 6508, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6514, Parent: 6512)

dbus-daemon (PID: 6514, Parent: 6512, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6516, Parent: 6514)

dbus-daemon New Fork (PID: 6517, Parent: 6516)

false (PID: 6517, Parent: 6516, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6518, Parent: 6512)

dbus-run-session (PID: 6518, Parent: 6512, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6519, Parent: 6518)

dbus-daemon (PID: 6519, Parent: 6518, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6520, Parent: 6487)

Default (PID: 6520, Parent: 6487, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6521, Parent: 6487)

Default (PID: 6521, Parent: 6487, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6493, Parent: 1)

accounts-daemon (PID: 6493, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6503, Parent: 6493)

language-validate (PID: 6503, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6504, Parent: 6503)

language-options (PID: 6504, Parent: 6503, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6505, Parent: 6504)

sh (PID: 6505, Parent: 6504, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6506, Parent: 6505)

locale (PID: 6506, Parent: 6505, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6507, Parent: 6505)

grep (PID: 6507, Parent: 6505, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6535, Parent: 2038)

fusermount (PID: 6535, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6556, Parent: 1)

journalctl (PID: 6556, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6557, Parent: 1)

systemd-journald (PID: 6557, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6563, Parent: 1)

dbus-daemon (PID: 6563, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6569, Parent: 1)

systemd-logind (PID: 6569, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6630, Parent: 1)

journalctl (PID: 6630, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6631, Parent: 1)

gpu-manager (PID: 6631, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6632, Parent: 6631)

sh (PID: 6632, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6633, Parent: 6632)

grep (PID: 6633, Parent: 6632, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6635, Parent: 6631)

sh (PID: 6635, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6636, Parent: 6635)

grep (PID: 6636, Parent: 6635, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6637, Parent: 6631)

sh (PID: 6637, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6638, Parent: 6637)

grep (PID: 6638, Parent: 6637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6639, Parent: 6631)

sh (PID: 6639, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6640, Parent: 6639)

grep (PID: 6640, Parent: 6639, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6641, Parent: 6631)

sh (PID: 6641, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6644, Parent: 6641)

grep (PID: 6644, Parent: 6641, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6645, Parent: 6631)

sh (PID: 6645, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6646, Parent: 6645)

grep (PID: 6646, Parent: 6645, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6648, Parent: 6631)

sh (PID: 6648, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6649, Parent: 6648)

grep (PID: 6649, Parent: 6648, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6650, Parent: 6631)

sh (PID: 6650, Parent: 6631, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6651, Parent: 6650)

grep (PID: 6651, Parent: 6650, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6647, Parent: 1)

agetty (PID: 6647, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6652, Parent: 1)

generate-config (PID: 6652, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6653, Parent: 6652)

pkill (PID: 6653, Parent: 6652, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6654, Parent: 1)

rsyslogd (PID: 6654, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6658, Parent: 1)

gdm-wait-for-drm (PID: 6658, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6659, Parent: 1)

journalctl (PID: 6659, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6660, Parent: 1)

systemd-journald (PID: 6660, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6663, Parent: 1)

journalctl (PID: 6663, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6667, Parent: 1)

dbus-daemon (PID: 6667, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6673, Parent: 1)

systemd-logind (PID: 6673, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6731, Parent: 1)

gdm3 (PID: 6731, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6734, Parent: 6731)

plymouth (PID: 6734, Parent: 6731, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6756, Parent: 6731)

gdm-session-worker (PID: 6756, Parent: 6731, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 6761, Parent: 6731)

Default (PID: 6761, Parent: 6731, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6762, Parent: 6731)

Default (PID: 6762, Parent: 6731, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6735, Parent: 1)

accounts-daemon (PID: 6735, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6739, Parent: 6735)

language-validate (PID: 6739, Parent: 6735, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6740, Parent: 6739)

language-options (PID: 6740, Parent: 6739, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6741, Parent: 6740)

sh (PID: 6741, Parent: 6740, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6742, Parent: 6741)

locale (PID: 6742, Parent: 6741, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6743, Parent: 6741)

grep (PID: 6743, Parent: 6741, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6744, Parent: 1)

agetty (PID: 6744, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6747, Parent: 1)

polkitd (PID: 6747, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6751, Parent: 1)

rsyslogd (PID: 6751, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6755, Parent: 1)

journalctl (PID: 6755, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6757, Parent: 1)

systemd-journald (PID: 6757, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6766, Parent: 1)

dbus-daemon (PID: 6766, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6771, Parent: 1)

systemd-logind (PID: 6771, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6830, Parent: 1)

gpu-manager (PID: 6830, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6831, Parent: 6830)

sh (PID: 6831, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6832, Parent: 6831)

grep (PID: 6832, Parent: 6831, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6833, Parent: 6830)

sh (PID: 6833, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6835, Parent: 6833)

grep (PID: 6835, Parent: 6833, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6836, Parent: 6830)

sh (PID: 6836, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6837, Parent: 6836)

grep (PID: 6837, Parent: 6836, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6838, Parent: 6830)

sh (PID: 6838, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6839, Parent: 6838)

grep (PID: 6839, Parent: 6838, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6840, Parent: 6830)

sh (PID: 6840, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6841, Parent: 6840)

grep (PID: 6841, Parent: 6840, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6842, Parent: 6830)

sh (PID: 6842, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6843, Parent: 6842)

grep (PID: 6843, Parent: 6842, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6845, Parent: 6830)

sh (PID: 6845, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6846, Parent: 6845)

grep (PID: 6846, Parent: 6845, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6848, Parent: 6830)

sh (PID: 6848, Parent: 6830, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6849, Parent: 6848)

grep (PID: 6849, Parent: 6848, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6834, Parent: 1)

agetty (PID: 6834, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6844, Parent: 1)

journalctl (PID: 6844, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6852, Parent: 1)

generate-config (PID: 6852, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6854, Parent: 6852)

pkill (PID: 6854, Parent: 6852, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6853, Parent: 1)

rsyslogd (PID: 6853, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6858, Parent: 1)

gdm-wait-for-drm (PID: 6858, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6861, Parent: 1)

journalctl (PID: 6861, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6862, Parent: 1)

systemd-journald (PID: 6862, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6865, Parent: 1)

dbus-daemon (PID: 6865, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6870, Parent: 1)

systemd-logind (PID: 6870, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6929, Parent: 1)

agetty (PID: 6929, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6930, Parent: 1)

gdm3 (PID: 6930, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6934, Parent: 6930)

plymouth (PID: 6934, Parent: 6930, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

systemd New Fork (PID: 6935, Parent: 1)

journalctl (PID: 6935, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6936, Parent: 1)

accounts-daemon (PID: 6936, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6945, Parent: 6936)

language-validate (PID: 6945, Parent: 6936, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6947, Parent: 6945)

language-options (PID: 6947, Parent: 6945, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6948, Parent: 6947)

sh (PID: 6948, Parent: 6947, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6949, Parent: 6948)

locale (PID: 6949, Parent: 6948, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6950, Parent: 6948)

grep (PID: 6950, Parent: 6948, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6937, Parent: 1)

rsyslogd (PID: 6937, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6946, Parent: 1)

journalctl (PID: 6946, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6951, Parent: 1)

systemd-journald (PID: 6951, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6953, Parent: 1)

polkitd (PID: 6953, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6958, Parent: 1)

dbus-daemon (PID: 6958, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6962, Parent: 1)

systemd-logind (PID: 6962, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7022, Parent: 1)

gpu-manager (PID: 7022, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7024, Parent: 7022)

sh (PID: 7024, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7025, Parent: 7024)

grep (PID: 7025, Parent: 7024, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7026, Parent: 7022)

sh (PID: 7026, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7027, Parent: 7026)

grep (PID: 7027, Parent: 7026, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7028, Parent: 7022)

sh (PID: 7028, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7029, Parent: 7028)

grep (PID: 7029, Parent: 7028, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7030, Parent: 7022)

sh (PID: 7030, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7031, Parent: 7030)

grep (PID: 7031, Parent: 7030, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7032, Parent: 7022)

sh (PID: 7032, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7033, Parent: 7032)

grep (PID: 7033, Parent: 7032, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7034, Parent: 7022)

sh (PID: 7034, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7035, Parent: 7034)

grep (PID: 7035, Parent: 7034, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7036, Parent: 7022)

sh (PID: 7036, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7037, Parent: 7036)

grep (PID: 7037, Parent: 7036, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7040, Parent: 7022)

sh (PID: 7040, Parent: 7022, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7041, Parent: 7040)

grep (PID: 7041, Parent: 7040, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7023, Parent: 1)

agetty (PID: 7023, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7042, Parent: 1)

generate-config (PID: 7042, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7044, Parent: 7042)

pkill (PID: 7044, Parent: 7042, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7043, Parent: 1)

journalctl (PID: 7043, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7046, Parent: 1860)

dbus-daemon (PID: 7046, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7049, Parent: 1)

gdm-wait-for-drm (PID: 7049, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7052, Parent: 1)

rsyslogd (PID: 7052, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7056, Parent: 1)

journalctl (PID: 7056, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 7057, Parent: 1)

systemd-journald (PID: 7057, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7064, Parent: 1)

dbus-daemon (PID: 7064, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7065, Parent: 1)

journalctl (PID: 7065, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7068, Parent: 1)

systemd-logind (PID: 7068, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7126, Parent: 1)

agetty (PID: 7126, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7127, Parent: 1)

gdm3 (PID: 7127, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7130, Parent: 7127)

plymouth (PID: 7130, Parent: 7127, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7146, Parent: 7127)

gdm-session-worker (PID: 7146, Parent: 7127, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7152, Parent: 7146)

gdm-wayland-session (PID: 7152, Parent: 7146, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7156, Parent: 7152)

dbus-daemon (PID: 7156, Parent: 7152, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7161, Parent: 7156)

dbus-daemon New Fork (PID: 7162, Parent: 7161)

false (PID: 7162, Parent: 7161, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7163, Parent: 7152)

dbus-run-session (PID: 7163, Parent: 7152, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7164, Parent: 7163)

dbus-daemon (PID: 7164, Parent: 7163, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7169, Parent: 7127)

Default (PID: 7169, Parent: 7127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7171, Parent: 7127)

Default (PID: 7171, Parent: 7127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7131, Parent: 1)

accounts-daemon (PID: 7131, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7135, Parent: 7131)

language-validate (PID: 7135, Parent: 7131, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7136, Parent: 7135)

language-options (PID: 7136, Parent: 7135, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7137, Parent: 7136)

sh (PID: 7137, Parent: 7136, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7138, Parent: 7137)

locale (PID: 7138, Parent: 7137, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7139, Parent: 7137)

grep (PID: 7139, Parent: 7137, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7142, Parent: 1)

polkitd (PID: 7142, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7150, Parent: 1)

systemd (PID: 7150, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7157, Parent: 7150)

systemd New Fork (PID: 7158, Parent: 7157)

30-systemd-environment-d-generator (PID: 7158, Parent: 7157, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7165, Parent: 1)

rsyslogd (PID: 7165, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7170, Parent: 1)

journalctl (PID: 7170, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 7172, Parent: 1)

systemd-journald (PID: 7172, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7176, Parent: 1)

dbus-daemon (PID: 7176, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
X2Yb9u8Ntz.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4a80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa492:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaebc:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
X2Yb9u8Ntz.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa462:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
X2Yb9u8Ntz.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd200:$x1: POST /cdn-cgi/ 0xd549:$s1: LCOGQGPTGP
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6275.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4a80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa492:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaebc:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa462:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6275.1.0000000008048000.0000000008057000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd200:$x1: POST /cdn-cgi/ 0xd549:$s1: LCOGQGPTGP
6278.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4a80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa492:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaebc:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa462:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6278.1.0000000008048000.0000000008057000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd200:$x1: POST /cdn-cgi/ 0xd549:$s1: LCOGQGPTGP
6273.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4a80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa492:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaebc:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa462:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6273.1.0000000008048000.0000000008057000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd200:$x1: POST /cdn-cgi/ 0xd549:$s1: LCOGQGPTGP
Click to see the 31 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: X2Yb9u8Ntz.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: X2Yb9u8Ntz.elf

ReversingLabs: Detection: 79%

Machine Learning detection for sample

Source: X2Yb9u8Ntz.elf

Joe Sandbox ML: detected

Source: /usr/bin/pulseaudio (PID: 6353)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6653)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6854)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 7044)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: global traffic

TCP traffic: 192.168.2.23:47212 -> 94.156.66.188:81

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6433)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6654)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6751)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6853)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6937)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7052)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7165)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6307)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6487)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6514)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6731)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6862)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6951)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7057)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7127)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7156)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7164)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7172)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.66.188
Source: unknown	TCP traffic detected without corresponding DNS query: 17.83.197.105
Source: unknown	TCP traffic detected without corresponding DNS query: 37.177.34.105
Source: unknown	TCP traffic detected without corresponding DNS query: 94.67.241.105
Source: unknown	TCP traffic detected without corresponding DNS query: 38.7.218.155
Source: unknown	TCP traffic detected without corresponding DNS query: 125.208.203.231
Source: unknown	TCP traffic detected without corresponding DNS query: 16.227.60.245
Source: unknown	TCP traffic detected without corresponding DNS query: 66.216.30.102
Source: unknown	TCP traffic detected without corresponding DNS query: 2.21.102.199
Source: unknown	TCP traffic detected without corresponding DNS query: 39.227.221.185
Source: unknown	TCP traffic detected without corresponding DNS query: 245.142.199.13
Source: unknown	TCP traffic detected without corresponding DNS query: 4.8.237.129
Source: unknown	TCP traffic detected without corresponding DNS query: 17.3.118.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.97.77.212
Source: unknown	TCP traffic detected without corresponding DNS query: 45.102.50.229
Source: unknown	TCP traffic detected without corresponding DNS query: 88.147.139.196
Source: unknown	TCP traffic detected without corresponding DNS query: 96.238.34.132
Source: unknown	TCP traffic detected without corresponding DNS query: 191.13.63.23
Source: unknown	TCP traffic detected without corresponding DNS query: 68.115.255.185
Source: unknown	TCP traffic detected without corresponding DNS query: 144.97.63.53
Source: unknown	TCP traffic detected without corresponding DNS query: 36.219.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 196.151.40.144
Source: unknown	TCP traffic detected without corresponding DNS query: 242.248.73.191
Source: unknown	TCP traffic detected without corresponding DNS query: 90.186.39.162
Source: unknown	TCP traffic detected without corresponding DNS query: 96.174.201.154
Source: unknown	TCP traffic detected without corresponding DNS query: 253.59.165.13
Source: unknown	TCP traffic detected without corresponding DNS query: 45.122.84.22
Source: unknown	TCP traffic detected without corresponding DNS query: 47.34.233.118
Source: unknown	TCP traffic detected without corresponding DNS query: 219.143.22.114
Source: unknown	TCP traffic detected without corresponding DNS query: 185.160.202.75
Source: unknown	TCP traffic detected without corresponding DNS query: 89.92.216.3
Source: unknown	TCP traffic detected without corresponding DNS query: 132.252.128.29
Source: unknown	TCP traffic detected without corresponding DNS query: 100.42.177.39
Source: unknown	TCP traffic detected without corresponding DNS query: 42.211.64.196
Source: unknown	TCP traffic detected without corresponding DNS query: 151.4.35.166
Source: unknown	TCP traffic detected without corresponding DNS query: 182.218.175.45
Source: unknown	TCP traffic detected without corresponding DNS query: 98.142.103.235
Source: unknown	TCP traffic detected without corresponding DNS query: 254.84.160.54
Source: unknown	TCP traffic detected without corresponding DNS query: 93.82.94.146
Source: unknown	TCP traffic detected without corresponding DNS query: 117.190.232.35
Source: unknown	TCP traffic detected without corresponding DNS query: 179.193.240.199
Source: unknown	TCP traffic detected without corresponding DNS query: 250.116.49.107
Source: unknown	TCP traffic detected without corresponding DNS query: 94.122.239.111
Source: unknown	TCP traffic detected without corresponding DNS query: 88.201.135.226
Source: unknown	TCP traffic detected without corresponding DNS query: 106.31.122.117
Source: unknown	TCP traffic detected without corresponding DNS query: 249.53.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 170.181.31.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.231.94.173
Source: unknown	TCP traffic detected without corresponding DNS query: 80.205.58.236

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.297.dr, syslog.421.dr, syslog.177.dr, syslog.369.dr, syslog.269.dr, syslog.46.dr, syslog.215.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 38466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38466
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6105, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6307, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6351, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6433, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6667, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6673, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6763, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6771, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6834, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6853, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6862, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6863, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6929, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6937, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6951, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6952, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6953, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6958, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6962, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7023, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7046, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7052, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7057, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7058, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7064, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6277)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6105, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6307, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6351, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6433, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6667, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6673, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6763, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6771, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6834, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6853, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6862, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6863, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6929, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6937, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6951, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6952, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6953, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6958, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 6962, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7023, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7046, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7052, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7057, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7058, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	SIGKILL sent: pid: 7064, result: successful	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6277)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: X2Yb9u8Ntz.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/160@12/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6352)	File: /proc/6352/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6514)	File: /proc/6514/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6519)	File: /proc/6519/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6535)	File: /proc/6535/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6563)	File: /proc/6563/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6667)	File: /proc/6667/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6766)	File: /proc/6766/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6865)	File: /proc/6865/mounts
Source: /usr/bin/dbus-daemon (PID: 6958)	File: /proc/6958/mounts
Source: /usr/bin/dbus-daemon (PID: 7046)	File: /proc/7046/mounts
Source: /usr/bin/dbus-daemon (PID: 7064)	File: /proc/7064/mounts
Source: /usr/bin/dbus-daemon (PID: 7156)	File: /proc/7156/mounts
Source: /usr/bin/dbus-daemon (PID: 7164)	File: /proc/7164/mounts
Source: /usr/bin/dbus-daemon (PID: 7176)	File: /proc/7176/mounts

Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:75908EPphw7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:75909LUuYl5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:76898D6wfd5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:769425Lwuv5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:76957RDfIl5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77033dHP6N6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77036gCbIH4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77158cOAI87	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77201CAgfa5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77402n6gXw5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77413rXpuz8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77462HzarZ4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77516NSewI8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:776483ILD64	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77681KYhuH7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:77683WrZvj8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:78476MPeUT7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6307)	File: /run/systemd/journal/streams/.#9:78477Ct9JW8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/seats/.#seat09jtVoc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/users/.#127hyrT2c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/users/.#127VSjDCb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/seats/.#seat018jET9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/users/.#127hlDLoa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/users/.#127X05gJa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6361)	File: /run/systemd/users/.#127sFiuOa	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6423)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6512)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6493)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6493)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80174WYkHnZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80175hWQD4Z	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:801777UEcC0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80189VbyQx1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80193hEgmd2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80202N41690	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80293lK9nd1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	File: /run/systemd/journal/streams/.#9:80478PsPrr1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6569)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6569)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6569)	File: /run/systemd/seats/.#seat0lgb02V	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:80723za13ZL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:80724Cm4rwO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:80725HOF0LP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:79714nyyODO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:79796ssatNO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:79837VCjdCN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:81988s8eF6N	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:820930KyfyL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:80947EdNudN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	File: /run/systemd/journal/streams/.#9:82235CPuIFN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6673)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6673)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6673)	File: /run/systemd/seats/.#seat08ZP9LK	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6735)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6747)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81367hptKB6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81368ppEhG9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81383ROQ975	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81384ymVf66	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81385RpBwN6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81386WCW6I8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81395gVgGpa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81471xu0dP6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81490kTfYs6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	File: /run/systemd/journal/streams/.#9:81559uQjc06	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6771)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6771)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6771)	File: /run/systemd/seats/.#seat0IveKud	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84019ujERo4
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84020wHkod4
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84028CntON5
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84039vSvQ72
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84050bNo2N6
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84051KSpVk3
Source: /lib/systemd/systemd-journald (PID: 6862)	File: /run/systemd/journal/streams/.#9:84052NAApN6
Source: /lib/systemd/systemd-logind (PID: 6870)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6870)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6870)	File: /run/systemd/seats/.#seat0IEuWaI
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:845268h0OxN
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84527oxPrbN
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:845449W9m8O
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84559QKAY9M
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84575zhtk6L
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84576tDC1LM
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84577bc5oaM
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84578zAf5aM
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84579vHl73L
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84592cL4OEO
Source: /lib/systemd/systemd-journald (PID: 6951)	File: /run/systemd/journal/streams/.#9:84593aqIm1O
Source: /usr/lib/policykit-1/polkitd (PID: 6953)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6962)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6962)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6962)	File: /run/systemd/seats/.#seat0wWaZHB
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:846859IjAvN
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:84767TyhINP
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:84768kBQEFM
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:84778VH6XsP
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:847875DIEHO
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:84877ZNG89M
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:84956sZ9RMO
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:86078vjAStO
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:861700dGOWO
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:86216Vd27BM
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:86218hUiW1Q
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:85937G65htP
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:85949HHYAWM
Source: /lib/systemd/systemd-journald (PID: 7057)	File: /run/systemd/journal/streams/.#9:85950WVuRfQ
Source: /lib/systemd/systemd-logind (PID: 7068)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 7068)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 7068)	File: /run/systemd/seats/.#seat0lwLHwD
Source: /lib/systemd/systemd-logind (PID: 7068)	File: /run/systemd/users/.#127H9Vt6C
Source: /lib/systemd/systemd-logind (PID: 7068)	File: /run/systemd/users/.#127j3AFpG
Source: /lib/systemd/systemd-logind (PID: 7068)	File: /run/systemd/seats/.#seat0cFeg0E
Source: /lib/systemd/systemd-logind (PID: 7068)	File: /run/systemd/users/.#127HDhMXD
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7152)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7131)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7131)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7142)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7150)	Directory: <invalid fd (18)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7158)	Directory: <invalid fd (4)>/.config

Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6230/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6351/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6353/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6352/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/3088/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2302/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6105/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6105/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6228/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2307/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6361/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6487/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6358/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6493/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6257/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6257/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6929/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1476/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1475/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2208/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2208/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1809/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/4520/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1494/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/4518/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1489/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6259/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6259/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6930/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6935/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6937/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6274/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6274/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6276/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6277/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6951/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2226/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2223/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2102/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/6962/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2242/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1389/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/1389/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/720/exe	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2114/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/2235/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/X2Yb9u8Ntz.elf (PID: 6274)	File opened: /proc/721/exe	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6435)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6440)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6442)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6446)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6448)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6450)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6453)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6455)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6505)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6632)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6635)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6637)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6639)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6641)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6645)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6648)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6650)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6741)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6831)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6833)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6836)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6838)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6840)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6842)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6845)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6848)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6948)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7024)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7026)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7028)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7030)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7032)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7034)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7036)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7040)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7137)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6441)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6443)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6447)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6449)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6451)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6454)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6456)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6507)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6633)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6636)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6638)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6640)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6644)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6649)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6651)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6743)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6832)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6835)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6837)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6839)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6841)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6843)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6846)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6849)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6950)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7025)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7027)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7029)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7031)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7033)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7035)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7037)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7041)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7139)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6470)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6653)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6854)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 7044)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd-journald (PID: 6307)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6862)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6951)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7057)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7172)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6428)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6647)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6744)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6834)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 7023)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7126)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6487)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6487)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6493)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6493)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6731)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6731)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6735)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6735)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6930)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6930)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7127)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7127)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7131)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7131)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6433)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6433)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6434)	Log file created: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6631)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6654)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6654)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6751)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6751)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6830)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6853)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6937)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6937)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 7022)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7052)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 7052)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 7165)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7165)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6434)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6631)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6830)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7022)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pulseaudio (PID: 6353)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6653)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6854)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 7044)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-journald (PID: 6307)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6353)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6428)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6434)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6508)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6557)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6631)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6654)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6660)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6756)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6744)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6751)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6757)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6830)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6834)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6853)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6862)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6937)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6951)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7022)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7023)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7052)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7057)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7126)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7146)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7165)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7172)	Queries kernel information via 'uname':

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6493)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6735)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6936)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7131)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: X2Yb9u8Ntz.elf, type: SAMPLE
Source: Yara match	File source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: X2Yb9u8Ntz.elf, type: SAMPLE
Source: Yara match	File source: 6275.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6273.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
X2Yb9u8Ntz.elf	79%	ReversingLabs	Linux.Trojan.Mirai
X2Yb9u8Ntz.elf	100%	Avira	EXP/ELF.Mirai.K
X2Yb9u8Ntz.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.297.dr, syslog.421.dr, syslog.177.dr, syslog.369.dr, syslog.269.dr, syslog.46.dr, syslog.215.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.109.246.163	unknown	United States	7377	UCSDUS	false
154.131.151.2	unknown	Egypt	37069	MOBINILEG	false
204.197.131.52	unknown	United States	21922	WEBNETUS	false
207.188.112.177	unknown	United States	7029	WINDSTREAMUS	false
255.49.38.27	unknown	Reserved	unknown	unknown	false
180.248.1.153	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
193.225.219.122	unknown	Hungary	1955	HBONE-ASHUNGARNETHU	false
201.252.172.147	unknown	Argentina	7303	TelecomArgentinaSAAR	false
249.170.176.96	unknown	Reserved	unknown	unknown	false
34.160.254.224	unknown	United States	2686	ATGS-MMD-ASUS	false
145.138.43.59	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
254.218.65.36	unknown	Reserved	unknown	unknown	false
203.169.177.183	unknown	Hong Kong	9293	HKNET-VIPNETNTTComAsiaLimitedHK	false
48.42.138.11	unknown	United States	2686	ATGS-MMD-ASUS	false
121.188.245.139	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
150.239.131.53	unknown	United States	36351	SOFTLAYERUS	false
17.138.208.182	unknown	United States	714	APPLE-ENGINEERINGUS	false
246.160.3.188	unknown	Reserved	unknown	unknown	false
162.166.133.44	unknown	United States	21928	T-MOBILE-AS21928US	false
58.169.144.193	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
168.202.216.78	unknown	Italy	5535	FAOHeadquartersIT	false
188.163.92.13	unknown	Ukraine	15895	KSNET-ASUA	false
165.122.35.206	unknown	United States	3375	MCI-ASNUS	false
12.53.89.106	unknown	United States	7018	ATT-INTERNET4US	false
27.200.160.142	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
201.136.108.147	unknown	Mexico	8151	UninetSAdeCVMX	false
198.210.19.60	unknown	United States	27357	RACKSPACEUS	false
107.175.213.121	unknown	United States	36352	AS-COLOCROSSINGUS	false
58.186.163.197	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
82.146.113.120	unknown	Belgium	8201	EVONETNL	false
80.93.34.93	unknown	Austria	28919	STWKUFSTEIN-ASFischergries2AT	false
4.228.46.212	unknown	United States	3356	LEVEL3US	false
80.143.210.136	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
83.80.156.6	unknown	Netherlands	33915	TNF-ASNL	false
136.116.131.26	unknown	United States	15169	GOOGLEUS	false
86.240.244.121	unknown	France	3215	FranceTelecom-OrangeFR	false
190.173.139.214	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
253.99.130.206	unknown	Reserved	unknown	unknown	false
110.78.187.98	unknown	Thailand	131090	CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT	false
42.14.167.182	unknown	Korea Republic of	4249	LILLY-ASUS	false
252.10.13.114	unknown	Reserved	unknown	unknown	false
175.140.44.197	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
89.248.107.45	unknown	Spain	48348	CLOUDBUILDERSES	false
159.145.51.3	unknown	United States	1226	CTA-42-AS1226US	false
66.147.120.232	unknown	United States	7029	WINDSTREAMUS	false
126.226.245.12	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
251.118.241.163	unknown	Reserved	unknown	unknown	false
24.55.193.120	unknown	Canada	7992	COGECOWAVECA	false
182.96.240.22	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
173.84.2.118	unknown	United States	5650	FRONTIER-FRTRUS	false
153.90.135.78	unknown	United States	13476	MSU-BOZEMANUS	false
199.35.143.2	unknown	United States	36026	AS-CHI-CORPUS	false
87.219.176.115	unknown	Spain	12479	UNI2-ASES	false
18.131.34.196	unknown	United States	16509	AMAZON-02US	false
62.228.223.33	unknown	Greece	6866	CYTA-NETWORKInternetServicesCY	false
93.186.235.85	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
192.14.110.226	unknown	United States	29861	SYNTAXCA	false
170.230.242.151	unknown	United States	19524	COMERICA-INCUS	false
1.242.249.107	unknown	Korea Republic of	38415	GOEGN-AS-KRGuriNamyangjuOfficeOfEducationKR	false
38.128.174.35	unknown	United States	62516	ABB-ASNUS	false
108.86.70.51	unknown	United States	7018	ATT-INTERNET4US	false
200.145.124.72	unknown	Brazil	53166	UNIVERSIDADEESTADUALPAULISTABR	false
135.169.41.250	unknown	United States	18676	AVAYAUS	false
143.234.190.61	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
163.163.84.11	unknown	Belgium	5609	ASN-CSELTAS-CSELTCONVERTEDTOASN-CSELTFORRPSLCOMPLIA	false
183.121.161.156	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
36.241.88.57	unknown	Japan	37903	EMOBILEYmobileCorporationJP	false
110.90.115.85	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
116.13.223.250	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
43.63.80.178	unknown	Japan	4249	LILLY-ASUS	false
154.250.247.194	unknown	Algeria	36947	ALGTEL-ASDZ	false
89.166.0.173	unknown	Finland	16086	DNAFI	false
250.247.73.14	unknown	Reserved	unknown	unknown	false
107.172.60.236	unknown	United States	36352	AS-COLOCROSSINGUS	false
81.75.161.210	unknown	Italy	3269	ASN-IBSNAZIT	false
13.39.99.83	unknown	United States	7018	ATT-INTERNET4US	false
37.234.138.182	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	false
18.199.20.21	unknown	United States	16509	AMAZON-02US	false
120.41.245.106	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.60.120.136	unknown	Denmark	31027	GLOBALCONNECT-ASDK	false
41.64.110.241	unknown	Egypt	36992	ETISALAT-MISREG	false
191.120.186.137	unknown	Brazil	26615	TIMSABR	false
18.138.65.79	unknown	United States	16509	AMAZON-02US	false
47.14.54.81	unknown	United States	20115	CHARTER-20115US	false
86.56.102.172	unknown	Germany	20880	TELECOLUMBUSDE	false
166.8.131.142	unknown	Switzerland	11798	ACEDATACENTERS-AS-1US	false
220.137.57.140	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
96.149.226.248	unknown	United States	7922	COMCAST-7922US	false
250.73.44.80	unknown	Reserved	unknown	unknown	false
158.178.157.77	unknown	United Kingdom	15830	EQUINIX-CONNECT-EMEAGB	false
153.71.97.176	unknown	United States	14962	NCR-252US	false
74.64.71.214	unknown	United States	12271	TWC-12271-NYCUS	false
80.9.28.111	unknown	France	3215	FranceTelecom-OrangeFR	false
111.112.79.12	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
204.180.213.177	unknown	United States	1239	SPRINTLINKUS	false
164.148.86.251	unknown	South Africa	37130	SITA-ASZA	false
114.17.181.135	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
84.27.17.112	unknown	Netherlands	33915	TNF-ASNL	false
117.34.63.80	unknown	China	4835	CHINANET-IDC-SNChinaTelecomGroupCN	false
170.144.80.215	unknown	United States	4152	USDA-1US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
168.202.216.78	MGQwnoKsQp.elf	Get hash	malicious	Mirai	Browse
58.186.163.197	6HAisf3waN	Get hash	malicious	Unknown	Browse
42.14.167.182	eHjC7q6lsK.elf	Get hash	malicious	Mirai, Moobot	Browse
34.160.254.224	OkoW1fJya3	Get hash	malicious	Mirai	Browse
154.131.151.2	nag.arm7.elf	Get hash	malicious	Mirai	Browse
154.131.151.2	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	eXVk8fy2mg.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Gp3siaQw5G.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jJyX9NWkfV.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	BKihi3xpZY.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Wt3H2Ryp2H.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	6FmuGnkxca.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	F4rmjhI8Sk.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	PqlDn21G8J.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5O0sQxS3uy.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	IPww6YAtw2.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UCSDUS	y7cm9CKSN9.elf	Get hash	malicious	Mirai	Browse	44.32.102.117
	qTM7Q5Wv82.elf	Get hash	malicious	Mirai	Browse	44.83.222.178
	ysp6xCD6N0.elf	Get hash	malicious	Mirai	Browse	44.59.57.134
	bolonetwork.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	44.5.225.76
	bolonetwork.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	44.7.165.2
	arm5.elf	Get hash	malicious	Mirai	Browse	44.165.216.220
	arm7-20240709-0417.elf	Get hash	malicious	Mirai	Browse	44.58.31.173
	arm4-20240709-0417.elf	Get hash	malicious	Mirai	Browse	44.2.63.138
	arm7-20240707-0306.elf	Get hash	malicious	Mirai	Browse	44.130.57.21
	FTowJPpHr5.elf	Get hash	malicious	Mirai, Okiru	Browse	44.129.32.98
MOBINILEG	b3lcTjArym.elf	Get hash	malicious	Mirai	Browse	105.47.233.195
	bolonetwork.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	197.150.0.22
	bolonetwork.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	197.223.159.164
	arm5.elf	Get hash	malicious	Mirai	Browse	197.223.62.29
	arm4.elf	Get hash	malicious	Mirai	Browse	197.150.251.24
	arm7-20240709-0417.elf	Get hash	malicious	Mirai	Browse	105.34.48.59
	arm5-20240707-0306.elf	Get hash	malicious	Mirai	Browse	154.142.194.169
	3jI8pe3luL.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	197.223.200.102
	2EVe9Yt2R8.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	41.155.197.128
	A8j4kl6U9q.elf	Get hash	malicious	Mirai, Moobot	Browse	154.134.219.203
WEBNETUS	vUvgbnhi3T.elf	Get hash	malicious	Mirai	Browse	204.197.131.69
	https://paikaribaba.com/en?https://click.eml.johnlewis.com/?qs=a40c8403680418a8d89a0f327581eb7d371d04e82250472c7ae9d55935a29ee7859030a4617d3985900b52f0bd95c73b49630b3ecd730ae14b8db225da4502bc	Get hash	malicious	Unknown	Browse	204.197.172.18
	cOI5Ae4qI8.elf	Get hash	malicious	Mirai, Moobot	Browse	204.197.131.19
	https://aljassimaluminium.com/Archirodon-Sharepoint/ARC-O-15880-UAE%E2%80%93Archirodon_Automation_Project.7z	Get hash	malicious	Unknown	Browse	204.197.172.26
	https://aljassimaluminium.com/Archirodon-Sharepoint/ARC-O-15880-UAE%E2%80%93Archirodon_Automation_Project.7z	Get hash	malicious	Unknown	Browse	204.197.172.26
	jPapFUoxZp.elf	Get hash	malicious	Mirai	Browse	204.197.131.12
	RGVmM6SY6v.elf	Get hash	malicious	Mirai	Browse	204.197.131.73
	rQJydZ0McE.dll	Get hash	malicious	Wannacry	Browse	216.37.84.0
	SecuriteInfo.com.Suspicious.Linux.Save.a.4079.27759	Get hash	malicious	Unknown	Browse	204.197.131.51
	xd.arm	Get hash	malicious	Mirai	Browse	216.37.95.145
WINDSTREAMUS	qgtfQPgL23.elf	Get hash	malicious	Unknown	Browse	98.16.28.253
	y7cm9CKSN9.elf	Get hash	malicious	Mirai	Browse	64.90.13.71
	ahN4x3ahps.elf	Get hash	malicious	Mirai	Browse	216.83.254.47
	Jdxh215HCJ.elf	Get hash	malicious	Mirai, Moobot	Browse	72.17.175.151
	O5XVFL6XD2.elf	Get hash	malicious	Mirai	Browse	209.155.209.225
	https://hootbio.com/kinecta	Get hash	malicious	Unknown	Browse	71.18.5.241
	arm5.elf	Get hash	malicious	Mirai	Browse	65.37.196.103
	95.214.27.186-x86-2024-07-07T07_12_12.elf	Get hash	malicious	Mirai	Browse	64.41.17.72
	95.214.27.186-arm-2024-07-07T07_12_12.elf	Get hash	malicious	Mirai	Browse	209.230.52.157
	arm5-20240709-0417.elf	Get hash	malicious	Mirai	Browse	40.141.67.108

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6517/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7162/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nCvn:s
MD5:	950C966B2D13EB9A7DE3E887BBA6D5AA
SHA1:	8A2805F08406BBF7F4026EEE59DDD8D9D02457EF
SHA-256:	DACC96CC83E66944141F29BA22554396C2E54E743A92A7F6FAE9AFFFB07B27E6
SHA-512:	4555CEB1AF4DFC6918AA0D4DBE67C2752CC16DFA99E4BB29340CCADA1C0CFB8052B32EF5F5847DDB57297E56FA78FF54CADFEC99D94BD35A5830E677595C6F4D
Malicious:	false
Preview:	7127.

/run/systemd/journal/streams/.#9:75908EPphw7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.532829018803202
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M9b9H1dWxwvRqji4s:qgFq6g10+f+M9b9Vqjs
MD5:	90CB346F6FB1E3F29AA71E378E6985DF
SHA1:	25783806347DBC3CC2E0D760868E8B0B6E1ED26D
SHA-256:	42B7B7C0B869A3832DD477A6761C773E095A4F6DC7408EC5B9E815D27F9702F0
SHA-512:	297705A262526A6801C99B284E623858C3E12127F2D539786A7DC9DC724C00E9F1591AD14CD0C897A9972949E4D87D69EB39592D809B1BE32AFB7BA50A51A80A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=78671e96fb6148eb862dfaeb6cc3e1b5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75909LUuYl5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.529922687162276
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzIxRHSsXUVHQjg2jq:SbFuFyLVIg1BG+f+MkisXUVHUji4s
MD5:	CA8D09556B0FC639F31FD02679C5CC01
SHA1:	17FE7392A0D94ADE8A9282D407E4CAF1EFF2F7F4
SHA-256:	9775345487FE76446C08A2045CE0426E72359D71CFAF9510D68CBD9C8FF9F595
SHA-512:	FA05654248568F25D108F9DED9F8955F53E3ADA00DF4828992670D2A14440A2A57F4E1C3FA5ED50687115BFCE67BC9EF0D51FAB7DFF85E8A5366F475B295D508
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95ca1018252144b0ab3c9821827c8257.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76898D6wfd5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388702383732881
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvVU6R2A0cXWmTjsmM:SbFuFyLVIg1BG+f+M26OmzTjdCLKzK
MD5:	A66718CF3E98C1474654A7263387424C
SHA1:	652EE43BB8A9EE2A6CF7C09C31CCF192DAC1288C
SHA-256:	11DE883C51DB118B9C10D4D26D46F15971620C6CAA88E317AD17EBF0C41E9A30
SHA-512:	66C547DEA203A79C144D38D564048DECB296DD250D545D5EC3EA1C9F6D5BCC792D43711645F00CC2604C9ADCDF6E13AED8CFC3EB33ADC7C87CAB5D010D843884
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e37189b22de64e43991192f52de88a95.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:769425Lwuv5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.363353107191518
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp0WpQoUid+Psjs1Ha:SbFuFyLVIg1BG+f+MJF1d+UjosQu
MD5:	B789A72B829CFDB395F1EF5D5B9B8EAB
SHA1:	6FE1646593FF01E3A1D34964901A26348C54049B
SHA-256:	AF38163023651E23FBA9BFFADEDF418A267E8186674155776C62365923D533FB
SHA-512:	C2423B7439967E0F4C28508FE2B7FB26CC2ED38035FD41B6BCF40C7D726B5F9F172700579FFD83C5F647039C56590BE81A7A51F3C9DCBBF86E897AB4F5A9D588
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c08bed3ae5ad4d198b08f0ecbbf7d19b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76957RDfIl5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.390079290616473
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4G3DnVXwdUKWRC/s/:SbFuFyLVIg1BG+f+M4EJXFKWRYsZjtWQ
MD5:	4D45EBB4B9AAAF2C4C11AFD262BA0431
SHA1:	5B8910E6EB57AA73182DAB4B937E77D315712018
SHA-256:	F43D711934143A0E40CE39E19DFE9A0F955CD42B43C14851B280B26FFD7A94C6
SHA-512:	85CD924C9E8C9D3D1E6126596C72AEE4D19E8A66FEB451CD862D5C3894BC32B2630AD4268C000E283308C3DDE0A82C858B609DD6E204997CD0198833F3F1E338
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c5bafb1100249378764f33452932ef5.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77033dHP6N6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.408701072017803
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M7BxREGWABSGG0jNE:qgFq6g10+f+M7hEBkFE
MD5:	22D03C8B2241365FD3B34EA28C17A173
SHA1:	2E675CF492F7677F91192B0202DD06BD92A5554A
SHA-256:	D0BFB1DA015EAFD5FC6AE2FA434E60D2D4CAC9B10AC205FF8BBE45C488057628
SHA-512:	3328E96139CC0B7F627F84A9D1D5751FDC856C5CE693A7D5E7D790C34C2E50BBEDA5CDEFC7C997A6857AB3E925AFD9192833E79DBA4AAE641EC1DB435EF40FF1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=943980abd0074a9db429f7a8a3e8f7cc.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77036gCbIH4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.442946049745821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5TVVDS2sjsicWmI2d:SbFuFyLVIg1BG+f+MNVVD0jZcHcljX+
MD5:	50C952DD875140004D29590A909DC727
SHA1:	3A33FACAB996DE1D2406ADFDBF61D1DA579D7C4B
SHA-256:	399954F82B62F9FDD52E219D6856DDEDBB5DECB0B17EDFF574FE25AC51ED7763
SHA-512:	45B67E9AA1D1E267D4AD33FC07B6600A4069765208D060917A593498E4C79DD8710946114EA0B788AFF83A817C30203F1F1633903C18151FC2A6B8336B92907F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3734b07700e1426ea247e98012e3602b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77158cOAI87

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.381262521090718
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv1Tdd4hToHeMGdAj0:SbFuFyLVIg1BG+f+MyhTae9AjbVC
MD5:	B1683E9E40C81A1D8E95547D902BD3CE
SHA1:	308B96C3141FBA2CE6A14E42F7487AC283429002
SHA-256:	DF120F79256A4170140EF1B4BE6DC4959960858DF3CC80255BB333E5147BBF7B
SHA-512:	18B29CBB2B0FD359FD6A7B0B1CD183E098A33EFFFB70772A95A1A46C3D9499C42A2CC98CC4CFEA544C4744B144D49D7B675A83855DEFC35FF140B042693AA36B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9a6882586c4494ca6adb7848e86c8a7.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77201CAgfa5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.40908217237087
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9HAXcdbFRmXITBQUV:SbFuFyLVIg1BG+f+MhP5gICU5qjLkGq
MD5:	D0C65E29493AE7BACAC69F63BFAC91B0
SHA1:	0D97718F5F5763CD4B59725B8D12B4BFAD4CFDEC
SHA-256:	575882335A82FD8D23847F4DEEA658B2BEBF795FAE9765673E1F47BE27FF38E7
SHA-512:	4C16E3423471581C1E7B605BC03D53CABDE706962058DB180B8B2F756A1BE071B3A06EDB02DE469BD2B65EDAED913EE8694ADBBC733EDD749530665BF2A3219F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=76fec48f9296462192d922588ad1d52a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77402n6gXw5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.440087586843422
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6hVymv0DxJAIjs2ALAQ:SbFuFyLVIg1BAf+M6DpsVOIjNALyAZD
MD5:	6E24B9E559352F7245E1C10C791FFB4E
SHA1:	F9FAF96E64E7EAE972E9CCF1A2E8142108796544
SHA-256:	FBE9DB77D1AEB892A53E493079EA36558A68506A6C7F88CC86BFB55D1ADD4100
SHA-512:	2476556A5BBB899614C86B83B9FBEA1044CC8A3B4F779490F9916406F738FE76B783BA94A2DC67B97AB3076289B4A3007DF50F19392ADF4E9CEED21EB9D8801A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=077085d64b3b4738892ae537ade513e6.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77413rXpuz8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4765402882284535
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+ME2StPTEeTdqjdCt/rRMtq:qgFq6g10+f+ME2wQaSCDL
MD5:	36DDA0580920AD204796C6CF56C0ABE4
SHA1:	D0372A2CF4D49CDDA4903314B6FE158AC126ED63
SHA-256:	5DF09771B4D92A3F4E6048F6E82666CB93D87C37F21992353233770E9CF235CC
SHA-512:	E8BC63BEDD08DCD632757A2C6B1B85141CCFDEC34A4AC6BB71A72CF818FBA894A7D3E2FF8DD6BA8DD407DC4DAE9F9561E67F2EE14ABC01F14C2B7977B729E745
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=193e9b70b1ec4106a8b7f5f5f7324a25.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77462HzarZ4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.447932852029286
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M+MAEBuHq8jNdQIeXD:qgFq6g1af+MJAou32D
MD5:	628FF9E7616A2515E04B592D05CA44F7
SHA1:	DF87BD2282D343A64C73CADE245E2663B4949E42
SHA-256:	6226FFCFF3BF3258E711F8088C8275F648613C7266CB6463077D1E852F176A22
SHA-512:	A87E651CF3B2EF85074F32E1029E8A092E65DDF01060765660C4B9B2735005475ED4FF3E530CC15AD176DCF5C57DCDE0DE8F69517436426B784C4EAB4CB26460
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=45501ead0fc446718cfe310c60898371.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77516NSewI8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.394854220525023
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsDThWROLS1HxDdeZjsa:SbFuFyLVIg1BAf+MsDF9IxDdeZjNTZD
MD5:	1064296DB1A193733A4E63153EBABCBE
SHA1:	EB4C56B7DC3FC084EF5E0FFF71F1271243A5D9C3
SHA-256:	DD58E77EE3E9B9E3020085FB4EE5AE57221FEB14D4B29FC1152E555E3C92C045
SHA-512:	A2B2A00AA6900DB3851E07749F6086392550ED2B93A9F8240B00774938A3C1D884FCC043BA44EB0545C67598D829AB962D8F5E209EE02C139CCAB4E4A2D02456
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff6ea343b98340aeb4f3024fbc568f88.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:776483ILD64

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.418410010482283
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvRTNE3BRnBGTjEdSg:SbFuFyLVIg1BG+f+MsBG8MjLTTIWTIL
MD5:	A6297AE174852DE5BB5D3D7C4949DF38
SHA1:	AB453309D75FE1E7497E85402C5E1F3AA954E95E
SHA-256:	4F9ECBF3C81F0BCA172F843395C0FFBE6B3B1F01665EBA9725D79017395EE881
SHA-512:	E24F7EC21FFFD21B8530B8554AA83245DD8664FD521D9A17D89EF051699AC51B959EA4F17959FA6A1829B377B75A7B1828E68D3158B7CC4D7D22BC49926CE790
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e3366da845cd47c7bd48edc2f75a8736.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77681KYhuH7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.403614780613055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9y3mHl2yTZ8js2q:SbFuFyLVK6g7/+BG+f+MjYsZ8jNq
MD5:	EDA6B232255BA9CC6DE94979C927E532
SHA1:	94CB61D51AF24B899A14E9B63A907EEDF60A3329
SHA-256:	D650F19BF51D7D2E0A14F7F5E49107BEF536F323B3C2624EFFF3508CE25BBBE5
SHA-512:	907B1C74C22E5E27217AED3A7AF1EC469D6BF12AC70391D110A4B762E022A384178EB810B7D30F737C60BBA86C084CC49822DC4AF7934285190A5802BCF500AA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d68708ab45e427389eb65a541b106ed.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77683WrZvj8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.416932732110031
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsHuUAhE11KsTjsz:SbFuFyLVI6g7/+BG+f+MsHb+ELjNq
MD5:	3729FBD32172BC6FC4D47DA3D58C4DC5
SHA1:	8C65E82E151AD2E975959AFAA5924600E5FDD8C1
SHA-256:	6C90751D228573CEB1C25465C529F81A4414EB5721CB7947A0020440828781BF
SHA-512:	702E197C6637D625FEC453BBEA59962BDEACC5591A19DAE4CCE24FCDB1F3E000BFFEE77BCDED217E4FCE46CEC9ED5B0A2B615C4F64C7FBFA5DD57B4A4AE65163
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fbb46e3912eb47c4b566c69b02619904.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78476MPeUT7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.527062956298966
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MBg6gnNTHdPa0jFQMzKaBu:qgFqo6g7/+0+f+MBg6gbPa+Tmh
MD5:	F275C8697F27B69D5CDF68C1EE1C1B0E
SHA1:	543D1D987D1B16919D56A3018F71868A8525EBB8
SHA-256:	7A02C55F0A4B50178D12E47CEA7C588BD7B8578F8B3D0C535DD8A90DEDC09FA0
SHA-512:	43CE76F419DC6A3FB5B2146FD44015CA2B3F1ACDE7F4D8743CB0E6E42F2DE5417896E3A13B08487DDE06E7FF3B807FA73BBE369E844452358604DFFE5E4D8E73
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c27e4cadaa4c4d0fa9286b8331980195.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78477Ct9JW8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.505481675462588
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MneD1TjFQMzKaBu:qgFqdg7/+0+f+MneD1NTmh
MD5:	7BC669B355EE7C36ACB382BBF4459E14
SHA1:	2AE4634270932E8628C968BF3966A73C4C1DD879
SHA-256:	C87D8BF0275089FF3D2DD39EBF67199DE7A5C3CAD2E04B6A9E33B34F5C1014F4
SHA-512:	77936B7BB49D3CABE5AC70C615F077457BB2ECE22F823BD759EDF3DA541679E2347BC653619F06E963EE345BC78DBE0299FEA067A66B23BDAA2266D7882EA8D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ef62cf57a6c6411b90e9a50fd4c440e4.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79714nyyODO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.451196360476749
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+bjTPec1gqnDXsjsc:SbFuFyLVIg1BG+f+M+VzojosQu
MD5:	339E5A64A8E57CDEED740AFD2E33303D
SHA1:	6DEBBA668A1B4863ACB9A3C1EB29F673FF9A3B66
SHA-256:	F431B64E06CCC2108663C2326629F09FFC9986F2EC77607F60F0BD617631BFE6
SHA-512:	C7C8D692E82C2817618F8F7AF85EBDFBDE40C4544EE5B0B7BF4A7E6AF73426993EC3486C6D0D0B17CCAFE358BE8608E67A1698B6ED8C1DE4F559034B5B726A29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4af585aec6e9416c999a58821f93fb71.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79796ssatNO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.406536546927818
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4KSIXRL5qjdCLKzK:qgFq6g10+f+M4UXvgCLAK
MD5:	1A4C7DF7081FDC1FF9295E800D4EAAEF
SHA1:	63DF08A462D1025E99CF84A07BEB770182EF85F0
SHA-256:	D0B13FCB58A809F0EEF8C6BB019F7E5BB2691BBD8DEF3761080021DE754CC3EA
SHA-512:	7809D98CE1CD68854A61F1F46C93637B684585006C9D7D71B3976C5A4EECC313572648A86615D4D85F491EFB3B63C603B85FD44CAF36F1AC03552E41A36578C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2080a42fb2264e749ceb1576fb9c4239.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79837VCjdCN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.439661060832264
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyLR0ld2ATjZcHcljX+:qgFq6g10+f+MC0H2ARmAu
MD5:	2454578A66D0BAD88D0BB83833D311DF
SHA1:	C9BFCE015FB4A48170EDC97A23BC829E0F483E71
SHA-256:	2D54BB789174648CFE3086E7FEA411B2D348A5770D6B4E31F9A72A3564CD382A
SHA-512:	3D3CEFF2A1D9A7E807813AC304403EEBB1CA607ADD2535440564195110BFF43A6D951BDD0A68C47042FA6AB287FF0BE2CFE91161F84C8534A10719712168F2E6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=816ded50a24b4d7b802ac88e2abc442d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80174WYkHnZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.543651651591844
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7mdAI+GB5WRGSW4T+:SbFuFyLVIg1BG+f+MydA5RFzTji4s
MD5:	4B3844073823BB1D9CEC909D364B7473
SHA1:	222740BC462EF3B98A645745B45B90F1F137A7BD
SHA-256:	222E6368045F5EF3BA89F63B50B7AA39C15A1610B328788DFD93F3997E210FE7
SHA-512:	B51696FBA4739A9705CCBC95FBEB463C256A832D9F588B3835A9900CC8CA38375FA42E2BB6452E07106E73AB0C1CAB61EDA8A9EBFDEBD522E43A1C08446ABFCE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12e7353596e14a2c8c149b70634c7357.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80175hWQD4Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.367950818327035
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmus767SdUOGATeATje:SbFuFyLVIg1BG+f+Mu+2TuT9jdCLKzK
MD5:	C1D509A28381F46F471B614EB8BA397E
SHA1:	3B7D9F66D312EFBEF221251F738F3BF3411BC015
SHA-256:	0890CEB632A332AB6964BF96550A82DCF9BC7668B21B3991F0ED7C2247BA4344
SHA-512:	A1EF740CC7FE704221605A22E135BC3709708AC2EEB026E880943CF3130B1206DC369485BAA2B8639CC51B3357C45CC6BF3527288403871A5C5D032F1129EA65
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4fa9fa3f7a6487ca43dc859763ce6fe.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:801777UEcC0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421651056606635
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+BVglGhdPKNrxsjsc:SbFuFyLVIg1BG+f+M+Bi8dcrqjosQu
MD5:	462D817318894789B963F1B1BC1DE8C6
SHA1:	E2B96D3A25B580794370F585D47FAA117B4CBC2C
SHA-256:	CD17D56C5F5662F5E60AE96B4907BB7A6AE78054D8C2D1755F0A9E3693AD0972
SHA-512:	6F9EEF0F7966A2772A37E8F79FFF12EAF8C99CF0C9069063048EFDB7989EF6465D2A39D962DC289B7426AA3C4B9950A40DEA162858DF8C320DEE551776D00399
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=495224ba5e144922a0bd2ec0b68f316c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80189VbyQx1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.34593028300096
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/3AdtTQmb/UB0jsmM:SbFuFyLVIg1BG+f+MYdyUTjdCLKzK
MD5:	2868974F6C48477EE5AF8A5592E30D28
SHA1:	864808D12A0225DDD50E28FFFFD4F0490AF93C60
SHA-256:	3F7B7D56F7DEA752FDDD6A8A2218B6C356C743219F63C9BC608923DF6AE647A1
SHA-512:	0CF2CCC214A715EBD703FC22A3CAD4AB68D67833B7F29A354DEE305F674935BB2208E0957F5311B223FC323EAA667266AD56C3A33BF2C6C10CD5F147F2DFAB03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5e7e85eb4cc240d285e734ca200522f8.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80193hEgmd2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.496802738072932
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzMj7XdI0ZjsicWmIo:SbFuFyLVIg1BG+f+M+jZcHcljX+
MD5:	A498C9299F4A57833137E7D9B09E87C9
SHA1:	6E43876146C78C8388225348A36AFC5AD06D680B
SHA-256:	BA3D5B8A1C2210D6CA115379B9C42A33D109E4DBAC49D861FF69ED1FB1FEF1D4
SHA-512:	562743AB5A80DFC42FF959A9DAB07435274472B0D285C6FE720DBDA51091BF9DAF5004CCEBAF3372D138BE422B22E85D8F83858E413DFC3E12CFA4E91F8BC650
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=964208dd243047b7bb3bca719d684735.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80202N41690

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.531629886654551
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzMVh26T1ETjs7LbgS:SbFuFyLVIg1BG+f+MI7fKTji4s
MD5:	F829DD1CDCFCBA79525211551CCC73B8
SHA1:	52376B58A05BD449E8A1227DEBD03B8E4CE2D251
SHA-256:	875BE180D0D032D2E39C8D3874CD668428EB8C8B17BF3436FBD0156F1822B291
SHA-512:	DD2BF88D58BD094C992154EFA6EF42B597ED812DE4FCE1F4D93985DF76B73258874AB83E441CCCB410E69DC961343BD326BAFB5E41218976049CCC7AEF3AE117
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9162c68dc0374f2dba93b2f12716e0ef.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80293lK9nd1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.382931389366434
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5zcRUGBwZEAvsZjs2Ax:SbFuFyLVIg1BAf+MGRUW5A0jNALyAZD
MD5:	1271600D3E4F8A32905C13B97D569989
SHA1:	39978B6912C4C4A652D67A145C9B34F97FBC3BBA
SHA-256:	DDBE2053CFF0F4E66670FEC1AC58B181D5F895A1890C67F2B41E0B05AAE58405
SHA-512:	453566C90D79972809CF66363DE214FDD170B2B5F76C2B66A5225DB793C1382FDC45E780FF06605C5E54EA33D0BEC84B1AFC808EEC9930C93A5EA00AE7B9D57C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39e20aad16fb42368ade010a6be3cf8e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80478PsPrr1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.5093618971407095
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4d0PSA4yUPRR4r/sjsd:SbFuFyLVIg1BAf+M4LRR44jNdQIeXD
MD5:	9171711D4249D9432B52E2C9FE517E59
SHA1:	AFC663F4F4DC6FE4887D491396C819B37B55595A
SHA-256:	D02F5D1DC078D4E08D2B1A977E19202B2E7047FCD50264382C9B981A7302D03D
SHA-512:	17D13D8F42C94FC4320E81CF3103DA169D1D808185A22389A0158F38F132235E0910B9C5FB65358DC85FE55A6751691EA508BDE4D3CDBC8A4987832D90A8C624
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26477832137e456bbb716f445c3590d2.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80723za13ZL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.524308236157954
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpYXBW5RRAncBrGJFp:SbFuFyLVIg1BG+f+Mue3nBS6ji4s
MD5:	EAED60107A31641691589796D943A42F
SHA1:	B0E9B2D402012A9213FA67BE9A6BF5F0323AA593
SHA-256:	06E9C17738FBE1FC0DA2051AED9039178BFD3AC9238D4F43600D689B33ECBF44
SHA-512:	591F84AAD401EFEFD3C1B54172CEE3B631838BE20BECB1D9513B91973681B0723D3F6C4A2ADB1C1B33367870ECDDA4F3AA7D3A09F0DA2A5BE3EC4BC8DCE9F741
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cf3d62d3b5c044e19b1e93c038623fc4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80724Cm4rwO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.383676510859725
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm62ARD9AbCBUicdWHV:SbFuFyLVIg1BG+f+M620D9vRvATjLkGq
MD5:	F8A4E15FB10C7FFA72EB4409DF6345E3
SHA1:	66D01FA193D505AA49608B1577FBEB6A63DDB66E
SHA-256:	D5CFB29AF9679777DBEF0797D73374DE452B6C2B2F9BD49EA84D32C5E92EC2A5
SHA-512:	004563036CF5CD7E7D63D007ADB2335FFB1C64481257F606E8AE85467AA6E0E8315AA490BC96CFD985C16DB221BE7F5A893650C8F09C3988407567B429751A29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02a811e4f3924f9395234c1304fe82cb.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80725HOF0LP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.498444884432887
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsGDLijRvJxsjs7Lbr:SbFuFyLVIg1BG+f+MsUcvkji4s
MD5:	9060E54F33AE38BE96677197BCF67A3F
SHA1:	7EC5424475A136D931766B873E6B83ACFA1B2AD7
SHA-256:	01DD515D28BCC2053565A7140E01D673270E791F5F5AD70D16C451D193C5F69B
SHA-512:	480DC7CC066FF8D0277E6F04ACCB7D4468B11DE950E4E8F25A32F6955CB782A4350025F0241999387E96079C0BF769D86AA742A481EDBAE7B76007EBF852A784
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fcfc9268c29d417c8aefaf013a6d6a72.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80947EdNudN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.398996530960959
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6pUqdaRInWqWY2js1:SbFuFyLVIg1BG+f+M65FWqWbjbVC
MD5:	D333AC56B3F5C92EF9DC66E320D37195
SHA1:	486DB3E2E10D7E1FB29773B336E3CAB474A9DEA6
SHA-256:	A699A1474394528696A05C4132C79FE531028C5A5430B8BE5736C6BD9F3441C1
SHA-512:	CCCEF45ABD4DF7DEFD54E6CD60ADC89B5A2FABD226228B263C5AD92C604E7464D74D497FB07922528F461D56A91BAF416B50982E5B4BF281F470CEE0300E2711
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ae1c46f89a54999b7eec3af9e98b674.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81367hptKB6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4827059830681915
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+Fd0bpMAdaZjs7Lbr:SbFuFyLVIg1BG+f+M+T09Kji4s
MD5:	369DFB6327FA6F1D3A92054DD28535E7
SHA1:	33AFDBCDD5AAA219F885823AFE762CC94682A352
SHA-256:	A264810A5F63CB2B1CA0F8E386ADA75CEEB902FE31F0520C4F5229C8EE3ED43D
SHA-512:	5576C4B31CB8C948A0A4852599C4B97E3EF0D7396222C6911C06C0CB7467753E83B0FBE59072DD3DBC54E8556BD2A996A64FDDFD3E21DAFA394C96854FD6FF46
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=48af9718a8df45a882f5e533c3aefee9.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81368ppEhG9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.431357906429553
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6K4KSdbGAkjNq:qgFqo6g7/+0+f+MX4KuWq
MD5:	C953AB806172993131520B31D01531FB
SHA1:	F62042137651A2CFD68EC5B2E6E3EED4FE14137A
SHA-256:	4BF0F210A2BB08A3D5DBF7F978F3D33020A2EEFACD035ADC8D1856DD8C5D5928
SHA-512:	93640CA5CDC8C6734ECCB38F899B2419ADDEBC9ABBEF9BC794660FCE2075907EC4C1BDC641D77AF904B968B952E5A8C7CDD2A96934F33EFD0D36AB7F2A1712DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=084cd87ed0bb45f99f37a6e974639ce2.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81383ROQ975

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.461697121613623
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9Nw8EiF3hQZjs2q:SbFuFyLVI6g7/+BG+f+MLthQZjNq
MD5:	3DC8545884F8D5968F9B5BE7F1925CC7
SHA1:	92D685717AE5750745F956C1C2A61A1BFBB5251E
SHA-256:	B5872C49B3BD0316E7832A0995398131B8905D1BD1EAFC6AA3DBC1CD9C7A3956
SHA-512:	24BBC137DF64003420E92DA50059F59A5F20EA728D44FE64FACFA2693D8A448FC9E24D4C1CEAE5A87DBFC527B887D7D1754607B29DD390B376409FDC46214EFA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7286211322b548c79593b8b99c68e776.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81384ymVf66

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3637072162678
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyiTHHdAygKsjsmNzi:SbFuFyLVIg1BG+f+MywHrijdCLKzK
MD5:	426218DE6BEE13814E17CB7252F8A559
SHA1:	93C6C3A0DD1E9018B977035443B246F2453B0177
SHA-256:	D08926CE4925042D3B51CE7304D1758921640239684580CC6BB2D3DEB4BAD633
SHA-512:	8415D9C675BD9967EA78140DC91CB7CDA86913AE12192043C40130FCF70F59D046FE3356CC762093C62EDCFCFD1C40DD8486B8DC33CC6E741A3A38C522762DB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87732ea5582048e99b76bb8ee2d3debb.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81385RpBwN6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.376752353065073
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+hUV8DqmM/v8josQu:qgFq6g10+f+MIVqmMaQu
MD5:	2755523E20951F1516724A7E6CF586FF
SHA1:	187B7731C51FC2F644648320B2B7ED8DBDCDEF33
SHA-256:	441397839E4D5971CB11F1B5BCEB563EB9CD6C91AB8350561E3CB80825D51151
SHA-512:	36297FA260F837D53FE043F46835072D2519CBF55B4444A35D6D6AFDC8B89A9A6DC6B3D9D4AB951E878F1AFD84AAFD0948DA051CF55D6E4D8596940527E6905A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1414b10f1d264d0e991333bdda922fc1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81386WCW6I8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.474557951756654
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoAcH32rqjsicWmI2d:SbFuFyLVIg1BG+f+MoRG2jZcHcljX+
MD5:	7555A45850F1F2DD989DCC90180BBA33
SHA1:	3889A1E63778EDCE634B7AEC9706757B7F673F4C
SHA-256:	C694881EC5B374ECD7A1F7AB6A9C1E1D4FB109C46F0F4F91550A1878C73BB0F6
SHA-512:	3E5486F12EDA3DB47ABD476CDB54F7A0DD76AE98B788B07EBE3DB192E04C83DD7AC69A549644029EA649B2019B316156FD39FE1617F95686CB8348826C6DBF8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bea720607f22417b979182e902b05028.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81395gVgGpa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.513620122034924
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrrTxwIyhJQhTjs7LH:SbFuFyLVIg1BG+f+MDxwNhJQZji4s
MD5:	9564E860CB9DAA5454674A25AE2660A4
SHA1:	F380F423ECAD12EB97E2DB4E1DE3CF392CA9E83A
SHA-256:	9989F431C16BC48D0A5AC65AE07B2C81C1CE997F631A72F813E3AB4A889D396E
SHA-512:	2E25DC775BA26FB9386B80E7F6331FBA63752CB72814621C85E6517EFB2DD8BDA8807DEA6D02F7B75088B829BEF9B763C4DBE0D63A76DF2283260965D7CCA5EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0db403c17b54660946a84bf0bc6f9b6.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81471xu0dP6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4153534622577375
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7ndPLAcdX6c4KTjs2Ax:SbFuFyLVIg1BAf+MJPKYjNALyAZD
MD5:	AA5325F326C36183B4B72DC0B9562669
SHA1:	854049186D9739530B5FDC5E22B6C16F188C9F30
SHA-256:	17C356F32B58111926B5988A56BC670506C86F44E207CCAD231062A561112724
SHA-512:	85FBC07E367A36424E4F336645A11E149C1AB49200E74CDE506FC29869751F2CA4D3390FD7796C0CC8D27F8DE486D524E65BF94110CA27F8C7E6694F3B4252D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14d80398b7d34ea3982cd10dc0918415.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81490kTfYs6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.457994240922243
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5E3I7JValGTAbAg2jsd:SbFuFyLVIg1BAf+M77JYc6ATjNdQIeXD
MD5:	D6C198BBFF4C3724B62535F8678B5F2F
SHA1:	FF36E31970845506A72EFE9904A7B82B33516454
SHA-256:	CCDB70C8CED1D3899A27930679AB1635F2C1DD81A35BA80BA454DB8E5640769C
SHA-512:	1CA312C72BDA671276C0EB6031444D0BE378356C75967ADB615193E12E07CA339E1565C24305B2A7F607FB45AEFAD716E144580755FDBA50AF0589E80534CF75
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b72828587e24e1aa0cd87b9c2fe30cd.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81559uQjc06

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.399758135705622
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm461HTxJXKmTGuxsj+:SbFuFyLVIg1BG+f+M44zTXKmXqjLkGq
MD5:	E908EFE9860E601A347DF040E518BD60
SHA1:	6664B176B386AF626981012D82FC253DC6B55C54
SHA-256:	15BE398A2312A6AC2699B703AAC8CD6D0220ADD368224BEC5C2CC56929208003
SHA-512:	6E6577EBEDEB48A2FCE838E520C2C6474DA50F8CC24DEF84FECD9D14C08C984206F0D86AF13510CF471893956F569577998974C50D89505427A213ACD7AA8F49
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=255e46b6db1948fc92ce05caeafd569a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81988s8eF6N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.3954720750798675
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/LQ8lBFxS8VN2js2BZd:SbFuFyLVIg1BAf+M8uxS8V0jNTZD
MD5:	82608B925F0CAC98C846A5254E477C1C
SHA1:	5EE527F149BA4A3E776FD4CD2513FE7AF667B89D
SHA-256:	F9F50118EA64365D91FFA15CEDA39E908363DC996133F1DDDA5236C9D1C3348B
SHA-512:	7801397D835598988780B4889CBBAE3BD3720EBCDDD8D88116B9C0321E968B48FB8688121A15D6CD648EADED51038B2AD2C08910853FB8E99596B83848D125D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c9582efc5934fd391b52043a9e10337.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:820930KyfyL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4603160194371485
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyfAuKn2jLTTIWTIL:qgFq6g10+f+Mfu+6EWEL
MD5:	FBF88FB1B526F760EEB92B065E484C1C
SHA1:	ECB25E09FA030DFB889720F81A29A60984F50EA9
SHA-256:	E0862A3901C086E50A355E2DA9FC5F9D057E5F28368C783209615A49F04ED653
SHA-512:	8EAFD5A593D45CD5B6ABC1B89672774BF5DD066201B901CE4CB2558F96267BD16ABC2233BEE66330BCD59AC5FA391844BD87013EFEA81E5FEEED640DD50E6A83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f10747bc7c042f3b4462e9684505e4f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:82235CPuIFN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.402551347777289
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuy2H21lurxsjswkCM:SbFuFyLVIg1BG+f+Muy2bqjLkGq
MD5:	0F1D410AC796D204D364B63AE772B719
SHA1:	F648B461DBF04E51CF0573224E1593FD4CC67A33
SHA-256:	A0D31E82FCD43F0CC725D6D24569E539F892DB72281B96841D7182E8288AC0E8
SHA-512:	C7EAD5A0D4628B494F3C6679343415A30D5B31EF7F620531E2A7F041F0D3D9C5CD950261787DD168AFD189DEF2A235BE486CCE0DDB005E10ED62CDEDDC8335A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de543c8e7be645218345d8024f4eb81c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:84019ujERo4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.496058924900871
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsa1TSglqSodBG2jsv:SbFuFyLVIg1BG+f+MsarYG2ji4s
MD5:	181684B85FC259BC3328DE3FD1483AFB
SHA1:	C6BA4744A19824BDE5AB2A60DBEBE3B211317AAA
SHA-256:	710D1100F9BB901469A9C8C5697B3859BD6817ED5C41D08F52ADE83424A4A70D
SHA-512:	17E5EDFBA78B40A0FE527A794FFB61BA0A1BCBE1A559D551E8B6B7CCCA8321A96B75C89BFC8D569E5708BBC80F45A8E45F9B96F04679D6975DF18DCC0CBE9B6E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f1fde768589f4eea865097ffe48c54de.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84020wHkod4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.343462434049146
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5khfJ2nSWRnhuqjst:SbFuFyLVIg1BG+f+MA2LnZjdCLKzK
MD5:	7143EA81D00CB338CFF9AA34F73F81E1
SHA1:	9BB0DCA83381630E6F2B1AEB1150D5E733BABECC
SHA-256:	CCB7C1FBB5E78D4ABB1C32CD1C551BDD241F8E4CFA06E439B7510CAC6D22408F
SHA-512:	9CEAE63C813348484351B59B06DD12689D82FAC75CF88968C9EDAFD12BF8ED6A7CDD635D5F734A7A097068976115A514B5DE4FD4690FDFE14579724B760D221E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=321dd0a5ce6a47cb94ed71731e04ce9d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:84028CntON5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.372565605251946
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmynlX2jyrcUZhW2rxU:SbFuFyLVIg1BG+f+MylgGN2josQu
MD5:	2FAE241DEC10EDCCC64B9C71FA0BAC87
SHA1:	2BC8973BD56941BAF7BD775F4FD116EDF0045C82
SHA-256:	CCA3F0B5B13E9EB8A22CC7A2E11F0F9CA92DC144F231C0A2456A9185CD99464D
SHA-512:	F32E83B0825027C5E735EC4705BB8D4553737EC561F202468A77FD95A62446D62FFEF231FDAC55CE948BBC97CA12F8BD1B4A8135CA8574A172ABBE22B80B534B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=84dd6cee6433415a9e9163e19ee85380.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:84039vSvQ72

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.495599726679794
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MomZ/SmFjZcHcljX+:qgFq6g10+f+Moz+mAu
MD5:	0327F7E5E8A4AC901093EC03D5D1F0ED
SHA1:	DABDCD6737462B874989E4C9B0288080AEAD68E7
SHA-256:	D9E48CB2E29471CDFDEC5BEA582C76FC5010ED2C5FD8389DCA4F5B78D44F2295
SHA-512:	2DA9D9EB9ED2CD69633FFCE7BD3D2701A25E90FD863C22FF1932E5E74F0826A176F47F4B7098893B64986A0B6130B67804B5F8776CFF44065DA70C0D21E2119E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b7ea7783db4b4c9eb86abfcc978f5346.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:84050bNo2N6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.396313989647904
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvWJzgVdUzp1g2js2BZd:SbFuFyLVIg1BAf+MLP8k2jNTZD
MD5:	6FDA2F99C2B79B7B392555BD85F5A394
SHA1:	148D945001D12FF04CF5EC27B42D76FBDD252241
SHA-256:	3CBB826D566A9BA36D1AC38C34ED50BFAE53033FC776D940E36BB430329A0D35
SHA-512:	2869C70C4C9F1C242956DE3C530E5F057F15617BFDB1B60B4FF50800B41C737BFA0E677576A3E354A30894C235131B2C6851DF864E88CF1FEF5710C961D80122
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e03b59e376064137b08d678af8978487.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84051KSpVk3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5459340793467105
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzykdqURFNlsjs7Lbr:SbFuFyLVIg1BG+f+Mus0ji4s
MD5:	631731B04723254CDB11F2AC7B3297BE
SHA1:	31D500B88C9E5733F6233A086A33909666FF8F8E
SHA-256:	E3FD5E6621C70D033FCAFF5DCD85A5DD642394F28A94A9EAEC212E8E8753CA20
SHA-512:	4845480EBD47207B6FECD597A3A709A409A4EE387C1375B577C3C6C528351F90701BD0D0A9A5EA302DDBCEA3FF2A78B9C442D7FCC26B65D0BC4B4100E733C167
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9c21839a8b71478d9147126d5ffadca2.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84052NAApN6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.381455519249454
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrsVBGGMTV0sjswxJm:SbFuFyLVIg1BG+f+MIrRMTHjLTTIWTIL
MD5:	0922F3CEB406FCCE20EEEFFF038EB08C
SHA1:	915C6A3E04C4F7E209535AC88C61343477C70BFE
SHA-256:	C22200C9B686B7AC0A6F3B51194ABDBBA711CA66233247DB96DE27A8B1E3A44D
SHA-512:	321863E19D5C2D4D0F5C61CA1BFC566888B7E84A1B01D158B3659437D12FCFE0C58AFD14A514B7E414D8E924A68048630CDBFADD7B8D4305011836EEC18482A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a1d0170dccac4a268241ca1506bb4132.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:845268h0OxN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.468298258598883
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp7ccyVVrrLNcjTjsv:SbFuFyLVIg1BG+f+M1TCfL6Hji4s
MD5:	CFC49AD849A406C80A533A94AB34D2B7
SHA1:	B1E7BB3E31A086192C0F9DD7A28F0AF79E1151C8
SHA-256:	9C0D4F48E043E1A4D8D6A4D82A97D835B4C841C3D4B4F1414D6161A37315C5F4
SHA-512:	6F0C408DAAA052B4C8F5077014EE54E575BCE4407ADE2569053870A0C21B6B5A4C80BA7A1FC4FF8FC94EA460A8A17E6681731B674DEE4DD255EC6B694AC71A50
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c06d69feded0400d95d0217aec5756a7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84527oxPrbN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.37581366459338
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/0gs6bW2TVNrqjsmM:SbFuFyLVIg1BG+f+McglLrqjdCLKzK
MD5:	1F914BB6B720339504942DF42898B2D9
SHA1:	76C043F71565CCE169821DF44ABC3C0F46ADC320
SHA-256:	B846F5D08ED4E1FCF5181774E4B659CA2BFEB375FF5A851B48BEB589FE54ECC8
SHA-512:	9C65D19BA2FCE13BBABC9646558876EE0A70EF596B877B25F6FA134F505E8C018E8A1A12CA86589640BD0E4ECF3CC8ADB3DE359DD4A0101935AB34A3479BEF95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=505ca58a691c4c0693d05309f39b6347.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:845449W9m8O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.403370174630422
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmylABRQIOjJAYg2js1:SbFuFyLVIg1BG+f+Mylk2IOjJAN2jbVC
MD5:	8A2A2E2B8A7B55E1DAC5984C1BDF2C0D
SHA1:	C36B542AA2442C5064ABF5C3875EAAB8E3C482D1
SHA-256:	19504967A8D8F17C5ECEB99ED42AFD247B96C943649E37BE1027DF6148F47AE1
SHA-512:	88FC77988A9A75953C6F24A3EE2A8D8108EFA4F7B4D6A1D349AEF5A96782AC50262266D76A198D3108C1CF95F189BD69CB9FBE1A73361EF403B18B1C1CBC8979
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c2eede59351403196bd073b3f13edf9.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:84559QKAY9M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4547658052649615
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8IO0djBbFSMqjosQu:qgFq6g10+f+M8AdxCQu
MD5:	D0601E0413ED5A338D0C52457878E415
SHA1:	6857E491BB61E7175C6B645103E97BAF76B3D191
SHA-256:	8C12771E6C81A1C8A6550FDBE4433FEF62C2AEC6BAB8CF9D004B6DED849C91D2
SHA-512:	AE80C36BDCFE22CCA9009E4FADCE7D24E06AC02596B3BB4235B767407B7AFF100E5C1821DB7D047959A50665A4D0040A01429F210F76B0A20A8188040BDB4F7D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=662f6ac80e97424b87342d9b6ea519c3.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:84575zhtk6L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.439588277054974
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M9+2RIHqjZcHcljX+:qgFq6g10+f+M9+2RIEmAu
MD5:	6D41EC0ED230DA6AEF7B109055B546B0
SHA1:	F00853C72421D7AAAD23110F1BD74284EE88607E
SHA-256:	EAC5C3586DFA206B54D07F7EE70DA498D484B3F17C87F61BE18660DC98FC8701
SHA-512:	D34D8B461E87766392F9C384B3C2964324E45D185806F947509CE91203D1444EC0F2BAABA01CC3D6817E9DEEBFD5AB356BEAE9CB7ED206C4B5A935FA30A0BCD1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1331f3aaab7a47a09cc6050fdecc65c3.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:84576tDC1LM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.384156633312177
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms6A9HooXdVHvYuxsS:SbFuFyLVIg1BG+f+Ms6QoKXHv0jLkGq
MD5:	247D36307049FDE3B008AD7585A5558B
SHA1:	7A900130E31CBCC0CD92072D2FE68668CCB1DF70
SHA-256:	D2C7157443298CA2C2AEFD315F7CFB9B802855F0F0EAB979F9B528E5D3427452
SHA-512:	6E4FCFB0D5FB1819737C5A06347EE415BEE27361A658A118BAEB871A9A101B79889328149B9879C909A4C8BB148769756418DC24CD8404F504F35F105F170AE6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f0906fec84ea470b9715bb421a0ba90b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:84577bc5oaM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4424982412561675
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvJ/WfWE/Xsjs2ALAXaN:SbFuFyLVIg1BAf+MM+E/8jNALyAZD
MD5:	86A73A9739BC756DDEBE55D5DCA27831
SHA1:	04ABF635FCBAEF85A464408A5ECB109E9537266F
SHA-256:	6BDD9E84D777E37023041E761301FD366FE4DFDE5C1A3E98806B2B2E0C832689
SHA-512:	E20D00E3CBC7BD7DAB2F4B3554E8FB3DA88BC3905DDD2FA54ECDFC7AD656DCAED1DD13EB5E51F44D1D13B9AE7C73C8847DD58FB869A1F0790EA981FCF817D37D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e151407b2a0246458d7a6a1b78dd33f2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84578zAf5aM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.510787075548035
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpuw1V3AE+QpJN2jsv:SbFuFyLVIg1BG+f+M8w1V3L+QbN2ji4s
MD5:	EB82C5545616DE963E9E8EB4281F9E19
SHA1:	110A4086FAD158547F4F3001246B319DDD42D826
SHA-256:	08B5FE823E4FC8D260312C87E271B0E05F17C587A8D7A88EDCA1B547114B85F6
SHA-512:	3EDEE2851393B96DDA589BC215990ED35F46C40869CDF10DD6D5FB94723B31D4C044E14656711459962648A496D74C03EFCD162352FA4E79196291530A497457
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cabe099bb7c44bf98c4075c98ce03669.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84579vHl73L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3569257870618925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ItEBRD3vYI2js1Ha:SbFuFyLVIg1BG+f+M2mwI2joa
MD5:	096E280069FB3F159478ACC7D3FF8934
SHA1:	871D579791EDFCA34ABD5CF5E20B94D48381C00E
SHA-256:	C5B57217144BC80C9B0F3A4471FAB3BF0140444B34ED708BEF975F571758E22C
SHA-512:	8F2F60495D28AF59FD8E5BC04A4E0B799D02C81130844083B95F87B57AB1CB90758783747D2B270EB9E158489F96C7419F6E4405045FE48161C4634D13917BD4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=715c79a9a2cc403baed4c0d79cfd27d8.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:84592cL4OEO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.457917570257897
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M6uHifyL1pF2jNdQIeXD:qgFq6g1af+MDH2y1g2D
MD5:	6D8C604B579C111C4959B1F330A8D65A
SHA1:	DC9548B798398965B611FFB3A00A151BD767E9DA
SHA-256:	AD3BAEDEC85153A2A1967C9D01053EB649F337FCC04E015F0B895ECCDB273BDF
SHA-512:	AFD2A7C74894D7037DC75172E1EE779950A5F132E0349C3BD63BBA7BB99701293C0B53150709BC16AB89CDC50A738357904A9CB1D38F58EDFC768FB091DCA33E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=078f415472c941cda178db4ce7fcd6d4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84593aqIm1O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.400238258158073
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvE3lwDEpGUNGgsjsV:SbFuFyLVIg1BG+f+MM3CDEoeGpjLkGq
MD5:	434B2BFDC7C440FE4B5BEF4FDFBA9913
SHA1:	0250886200DD11D68CDBADDCE9B9C9305696F1E8
SHA-256:	859D96153A49B65F2F4464ED547312F7CC11171171B9D0EB76ED46366290E1BD
SHA-512:	40900C64A260C878DEB5CAB15B561146369B81DF57756C6138126361197173A72D7054E905B0B36BD51CA56E631F03AE12EBE5601BB790F95096AF932A38FF8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec6020b8bd824f3fa0fc19bd17e20c50.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:846859IjAvN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.520650599588603
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu2qUMdfAqR0Zji4s:qgFq6g10+f+Mw9R0js
MD5:	D4EFA3450D26E7B34664B3977BF154D5
SHA1:	3A69BBDE44900863175B5E053DF6735CA912E45C
SHA-256:	E39E3F6FCAFFCF37A561D2149A9BF1C99EB1A7DEA71AAED7865708A52F00473E
SHA-512:	0FA7219AA54357EBED1D076F4AFCB3AA9A3C47BEF60DA8A47BD1F1021376F39C36A3048DA0A5D846D95A5934910A556CF230DF863A2E9A4857ED907F0477A4A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d8fe18f9d59f4cc5af6e662c34746af4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84767TyhINP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392979724483423
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoeRVdEmRS/HjdCLKzK:qgFq6g10+f+Moezdt0RCLAK
MD5:	3F802CD05FBD60266D34587545F350F9
SHA1:	EBC6C1932E4B0290E859D3B9763B554C338EB8C1
SHA-256:	E36E5B417EEADFD66B8B54082884074B4F27920B07EFA38782A76C0375EEAEF9
SHA-512:	D5F5F9F7982D047FFA16464777ACEA4ED3E35B7C35671BFA5742789829123658861CCC818926BC4032B306D22F4CD1E0BD4F906E3CE97115C3FC5B0895413017
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b67404ab1aef475b9dde6d7e8052841f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:84768kBQEFM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.451803592452946
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+0UGF3JarYcoVG0hJ:SbFuFyLVIg1BG+f+M+0fOkcCDjosQu
MD5:	99008B865583F0EF56AEF76A84279FF0
SHA1:	BCDDFCA20DF5D5F694EB91E78B7C15B9A56F3CB5
SHA-256:	F62C3F4E8B2ED9FCBFC6C782BFD7FFC29F1D29A10A135C2629A54AFC7A8465F7
SHA-512:	B5D2FBC2AE2B61F294BE7482140582EFD742EB259B594433CEADFDCE4642F069B62785BD9A6F176F89C3880C72AB6771C2A4F66761DAF2665257E7DAB943E530
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44ef1c19b2494e83866f1d945647a20c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:84778VH6XsP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.518173413044724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrpEzWAgAH8XASE5x3:SbFuFyLVIg1BG+f+M6gAH8k5qji4s
MD5:	D2DAC28E9CEDA17F331834F62CFF6E8D
SHA1:	06232178E903DD9842BB45E8713903E62D5AD058
SHA-256:	8FDD723BA5DFA33869F1BFEAB9C5C9148D4B6D42078B0027A8DBD7EBD7F86B08
SHA-512:	D67EA4239B2E1CBAE255E9C78A559B110EDEA0296AEE17FA8043EF5B76AF7C97A7F390EC843DEA46BD5DDA0736150688F50118B73892DA720596DD1036898A4F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0fa983f3b76445eb6846ebc07d9ce7a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:847875DIEHO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.505071785948459
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MlV6Icm0jZcHcljX+:qgFq6g10+f+MlTcBmAu
MD5:	3555CA5B90A6991FDC63E755C8D27F1E
SHA1:	D3112889FED71D6CD1082B97A9567C14B8EDB6F9
SHA-256:	0157D8D0F68B77CBA9DE2B3DC88AE0DA70B9DD948E9BF09803D1696C85177062
SHA-512:	9C1E4E5F2433108484A782C86D107CD8E69D0D7EDFD05A5064802478B21F92CB055F14F564F9D14DF4E6826055F24E8F2F78DD5BF8956383CE072FEE49F1EE53
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=529d4169233246a09850f4b598cc1dc6.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:84877ZNG89M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.408487605058678
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4HEjHGA2VjGuqjNTZD:qgFq6g1af+M4smt6TZD
MD5:	2E221DB945E1AACCB456E00833927658
SHA1:	9DED8B17B1382A680AA7F322F40D79B5D9C65466
SHA-256:	97F237488B816E1AA80C749C3FCF811649BE0D065932D9997DB0F16D6E7AD52A
SHA-512:	8CBFF3F3B4797BBB31A012C3283AA41FB7C87BF5CD4F0B88F0743D554745ADF424D3C55447DF32179837C11C7A483C1BF60858477FC65EC83AD01E86E1B85D10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2babfb2349f04dbfb548f7c600ebe505.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84956sZ9RMO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.397324301923523
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6UQBHBTU+c2rqjLkGq:qgFq6g10+f+M2HBY+cuT
MD5:	60832BA490D3A20EB451C73A94AEBC06
SHA1:	92111172E5CC7EB558893B4DEFB1FF103C74A4CD
SHA-256:	C3FF9DC35B5EE2369DC4DC94316EC8540162AAE642A9DF26D2DACDA814BB2045
SHA-512:	53D5F53852D053E7B7EDB39A148C3C0DC9A97A3648F1DA2F2616717F192258523E4B76A713D060D6F813F3105EE8F888E54393FB8AF63EAE391E1EBAD44D28BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0362ed52addb4f1a8a299538a9534fd1.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:85937G65htP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.435442133767376
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsHWopuwRqjZcHBrt:qgFq6g10+f+Ms22FkmBB
MD5:	E3B11D69E8DFA146CE0F660B87807F3A
SHA1:	9282DCE84F6E956618547054AC1F5DE2C9C83285
SHA-256:	7BB670C8E9047A431EBBA2B38355A5ED78B3E95B22B6041B20376DEE6665BAAE
SHA-512:	862A07A06B924571956D06E74FECE31C5232EE64C5646348A8D3C0F2F2DAA9C8A62915369A3AF25E933065A0EB1194E6011BDE7AC23341F2EEEE879A2A1EE08E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fb39347448434988a0b922ac36a0cd67.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:85949HHYAWM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.531243149435049
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8dQ85GjFQMzKaBu:qgFqo6g7/+0+f+M866UTmh
MD5:	55F95A6306BD73FFA24A2DF733DADADA
SHA1:	176EA1D17B9FCA3A63964EDF38874990007F6556
SHA-256:	78D08F6BFEE5A00F160631AA43A80354D094524BCED67698226C826E3169AA3D
SHA-512:	BEE04DB216DBDAD9D1036644650EDB563B8F8F211773A97AB5C8ABAEF8893499325924B5490FD8310701249E671BA73BAAF50C7F25517026435BBDF27BEA282F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=604698fba4cb45799b918fc6c4e74465.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:85950WVuRfQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.516864339870031
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MVioRGb8jFQMzKaBu:qgFqdg7/+0+f+McoRGaTmh
MD5:	066A29883D3A07D4356C288326D5F7E3
SHA1:	C522D9B472AD6D6636C59042B744BBD8B897BE36
SHA-256:	810709679C52E5933F1C33387174CE04C371476AF3640719289D995FEC1FDB14
SHA-512:	CB974B23D787FA99356D74A14550ABD65307519D07F26782CA4492CFCA43A89CD9FFB26FD0472DA0C355EAC32BEEE1DF8248B1761E95308DAA359BDAE3DED610
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=34d1234d86f74f3898b8bb034c80d857.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:86078vjAStO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.427000786057428
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8GMldcjGWPZjLTTIWTIL:qgFq6g10+f+M8TldepEWEL
MD5:	B35FBA9DC0A7980191BFFE986458F82B
SHA1:	D95BB4D6908C5A2492E0C758572E2571F6EE15E3
SHA-256:	FF4D52355F31370729BAAB46D3C434B069E7159F3E3AA3A203A24F96CBD1CAF6
SHA-512:	57B711790DFBBDBA1556A1E36B631D85D4E3D7D39AD7813EACB3D7893CC2D9BDEC3813B89AFBAA830FE83BF9E9239425B7F416141473DDA80B27667DEEDFCE8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6226216b983b4986a56ee19ce0fac3a4.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:861700dGOWO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4423945648743235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8A6WWCNc9lsjshKJg:SbFuFyLVIg1BG+f+M8nb92jbVC
MD5:	4BC43C9CEF89F8B5C105F25C3D75EB5E
SHA1:	1292B5BE851A86E4C4B939B8345351D29557F1F5
SHA-256:	7174879CD6860EABDEF9B2E43E55384EE666E6E59DD379292CE002DB33BB5F70
SHA-512:	A4D47DC9DCFE609E6ED9338903E200C993DB133CBA99D107EAA05D69E4880CA429AE583D613AEFFFB06306E65A648093FBD2F2FAA7B7494474AECC95C774FE5F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e1549f30f3b461face27958a197f92b.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:86216Vd27BM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.386973178060049
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MR8BVBq09Y2jNq:qgFqo6g7/+0+f+MRYO0Pq
MD5:	71714890056A0172D49C3D1CBDFD0B98
SHA1:	292663480926F33C422F6DCF835F67C385B140AD
SHA-256:	0FE5B2D25CC08186285CFB00269A9731CD2C50EF98A7A413B61BFACA8431A222
SHA-512:	4D31BF45BD3F4538C825E8B1C30633A9C1F44380804B8A38A6F4DDF2547F60B07D8CA4ADC5328E58A23F9D445946344927824DA530F9E3188DF47240F2C8D6A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a000947a0871484d8f9a14dcb861f093.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:86218hUiW1Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.435955839517963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7Nu7eWhCiEAcO0q:SbFuFyLVI6g7/+BG+f+MM3hCiyO0ZjNq
MD5:	6EBFFCDFCD517D1BE8CEF73642915B85
SHA1:	FA4305F1CA5BE81E6D3917D351387CB076A98626
SHA-256:	29321238C084A1F0F97D33BA3D1A7D0544F7BA1119B43C7DFEFCCBD85A869801
SHA-512:	D4D8293F33E2B20AB8AE4C3B464FC3860F73E53DA1EF739ACBEE328995B263443BE6C8A3E4CDEB74AA62BE11B5BB17F4941B142C9E3365AE38FF1DD8685297DD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=128ab16f3b0247b094775261b35ae912.IDENTIFIER=gdm-session-worker.

/run/systemd/seats/.#seat018jET9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat08ZP9LK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat09jtVoc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0IEuWaI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0IveKud

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0cFeg0E

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0lgb02V

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0lwLHwD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wWaZHB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127H9Vt6C

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127HDhMXD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.323000133675703
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff80QkfJgh1Lw2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE0xBgh1vthQHtPYqi
MD5:	982B758936A1B72980AF648BFB58F0F1
SHA1:	DE518F45A7CB3D3647B17B87CC93AA8C75A2BD79
SHA-256:	3AB29E14556A12B547A46BFB958AB7B296126D8F98E66B20541EB556DB8D29EE
SHA-512:	0CA9124FEE875C8315018A70ADC1FA1F0F5CDBF1788A26D0528A263EA68A98ECA41A914F75A7BD15E96FB6AFA50A70666068562FABD0E60744E233ED9C1BE8A3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14836.REALTIME=1720725526590870.MONOTONIC=622493485.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VSjDCb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29948263564113
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7ghRN2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+ghethQHtPYq9M
MD5:	884A68DFC76A2275B85E183EE5EBBDC0
SHA1:	7D52B86A9DCF119278AAE977B97438BD9169EF39
SHA-256:	13DE5C888BE85F05AFDC0B45D5441281855A0278F555308EAB98EF00BF9FC7A1
SHA-512:	2F15F3937217C9651E236FB68FF579B3889F058FA5F3BDEE88656C2571DCFE9C57C0C79F4347FC78D5104097B7B8647C072D75939003CB971D7D5CB011750D04
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1720725400920471.MONOTONIC=496823087.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127X05gJa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.330947934201739
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJghARV6DtDi206qod2Qbn:SbFuFyL3BVgdL87iesnAiRJghRWt6U+
MD5:	42CD5864B09BAD96EC819E5587BDA494
SHA1:	010720871998908579CF009E469EBA4751C0542D
SHA-256:	BC82F874392DCC6E7B3AF307EB663D966A6A2E8A380DCC0B4FCF78E9F149C2B7
SHA-512:	00090553CC29C2C2B4CD8D6FDF752AEB4FEC7C2FF291F0E3EEA5A6E77BF71595F8C941D3F8A946FD13D9A4BB906B92EADE0BD1A44381FE6003F2B9C46249038A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1720725400920471.MONOTONIC=496823087.LAST_SESSION_TIMESTAMP=496952073.

/run/systemd/users/.#127hlDLoa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29948263564113
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7ghRN2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+ghethQHtPYq9M
MD5:	884A68DFC76A2275B85E183EE5EBBDC0
SHA1:	7D52B86A9DCF119278AAE977B97438BD9169EF39
SHA-256:	13DE5C888BE85F05AFDC0B45D5441281855A0278F555308EAB98EF00BF9FC7A1
SHA-512:	2F15F3937217C9651E236FB68FF579B3889F058FA5F3BDEE88656C2571DCFE9C57C0C79F4347FC78D5104097B7B8647C072D75939003CB971D7D5CB011750D04
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1720725400920471.MONOTONIC=496823087.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hyrT2c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127j3AFpG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.323000133675703
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff80QkfJgh1Lw2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE0xBgh1vthQHtPYqi
MD5:	982B758936A1B72980AF648BFB58F0F1
SHA1:	DE518F45A7CB3D3647B17B87CC93AA8C75A2BD79
SHA-256:	3AB29E14556A12B547A46BFB958AB7B296126D8F98E66B20541EB556DB8D29EE
SHA-512:	0CA9124FEE875C8315018A70ADC1FA1F0F5CDBF1788A26D0528A263EA68A98ECA41A914F75A7BD15E96FB6AFA50A70666068562FABD0E60744E233ED9C1BE8A3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14836.REALTIME=1720725526590870.MONOTONIC=622493485.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sFiuOa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.480062808586093
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTghRWt6U+:qgFq30dABibB3TghAIU+
MD5:	33DA5F61164E24A2B4D71D616974DCC8
SHA1:	FB7683C2D0A0A7F28CF9F917E872D5C447986183
SHA-256:	69B336B553C37E810D7A744BB20AF3D1F69797BBA3768D02712521C597AE8E2B
SHA-512:	A87B43646FF600ECC0465622DF20CEE4AC6834ADC2BD1455C52C8DAB4B565D8919355AE55ED1E44EC02F8BE2821A721750559850F5991DA49290EF95BC0ACDDD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1720725400920471.MONOTONIC=496823087.LAST_SESSION_TIMESTAMP=496952073.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:bon:8
MD5:	7F06F8C8CBDFEF230AC667A4E58AEA2C
SHA1:	2BBFF30E76A6A941DD65DD208DAD66A817B42C84
SHA-256:	696AE90439F2BE89D1EA03042DBFD1A38FEE6340E6F0D6D89B17DFC5C3B4F5FC
SHA-512:	81032BFBAAD0D170F64B1313CDE1939E15CF55F11D8195908D3B4025A59BCC31CD152A51402DC60F6012BF75CC2DD7C0843160D263F0DC282616891097D41DA2
Malicious:	false
Preview:	6353.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:Y0sXlXEWtl/CN/:YV+ylqN/
MD5:	351081F7BB6185172CBD7891B20FBBC1
SHA1:	D84F4058974E9A6C328550B85C42714A6F19DA98
SHA-256:	D9A6D7CA072B5A51D46DC6CE2D6245672985088C985A64FDF9F608F8B66A8774
SHA-512:	826F864DA077B6F897B9C628923A84138BAE42F66A9FA668365C5E5BD74BF226AECD1E9106EEE0FDD10F866815DA97291F749337D87CF99C5A9046FCB9792FB0
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................0.f.Q......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:nJkn:Jk
MD5:	8AABF3189F2F7D576D3DBF4794B76CDF
SHA1:	3A0EF81EED55BCC7B7F139A34EEA7CCA602CB612
SHA-256:	BFE458FCF1D22AED2779FA56A57F451D5723FEDC50D1C83C19D742D1234DB9D2
SHA-512:	D29D406C08C7CD94937034FCC47AB9C46B326D313AC73C7C368DE9EB74069ED70F28BAF6A75B895BBCFF4CEA51D03FBE82A08D71FC851CEE7893FDE7BD20D2A3
Malicious:	false
Preview:	7150.7151.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:nJkn:Jk
MD5:	8AABF3189F2F7D576D3DBF4794B76CDF
SHA1:	3A0EF81EED55BCC7B7F139A34EEA7CCA602CB612
SHA-256:	BFE458FCF1D22AED2779FA56A57F451D5723FEDC50D1C83C19D742D1234DB9D2
SHA-512:	D29D406C08C7CD94937034FCC47AB9C46B326D313AC73C7C368DE9EB74069ED70F28BAF6A75B895BBCFF4CEA51D03FBE82A08D71FC851CEE7893FDE7BD20D2A3
Malicious:	false
Preview:	7150.7151.

/var/lib/AccountsService/users/gdm.6GU3Q2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.PYKXQ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.605930440229025
Encrypted:	false
SSDEEP:	3:FlRygWFGLLGNI9teXQLT3LLGNI9te+zWMKxFKWJXq1CIv:3WF0y6xv3Ly6mMajOb
MD5:	83B2906AAEBC16C87EF99B5BB94669EB
SHA1:	BE556787182F336E17DDC8824AB0E3831CC49958
SHA-256:	031CE636B3B92A86FC860A2EAEB1F289A9CCEB4C71E3682CD7BB39ED4F68A37E
SHA-512:	2BDB8D24FA6D051F03BBA869F9F339832938169178D81ECAF8ADA263B04C219335C5079CE7144E5ABD25CA7199C7F913335B42C35155EE586E983E69769412DD
Malicious:	false
Preview:	Jul 11 14:18:50 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlMv3i6/U8l/lav3i6/Us:F30c8l/lmcs
MD5:	7C354EB7ABE852E2ED61E8BD62AED077
SHA1:	762F25373E39F65FD71DB281BBDE6133DD176669
SHA-256:	BCC7E65E0892551C59125F094B07C52A075FDACB55B101FC89745B52839DBFB8
SHA-512:	17B67139070F2B169B3B2AB9D3BBD21B71CC134ECDC92799ACF08DA96D97B26C9BD27CC9BE660C532A6F7DAE69CD7E4C41F5192DA9E1ABD49B9E8414728D2640
Malicious:	false
Preview:	LPKSHHRH................J.7-JuG.,.8.1.................................J.7-JuG.,.8.1.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.308083899700076
Encrypted:	false
SSDEEP:	3:F31Hlq+kOnZt0+kOnZVX:F3aKZKKZ
MD5:	A2E9CCD1CBB31F1788DF3DE0287B8DAB
SHA1:	76A9F5C83E33BC6DEF8814FC3F09F49D08602BD1
SHA-256:	6DF3FFAAB25F9FCD5EFD4E3836F3079D66E75EBC3DDF62456DE351E75923330D
SHA-512:	00BFFC10C8DFF66779EB392F84AA7615BD18729CF80AF934F17FB64E3FBECCCB04344841010ECF20749D9D397A2A190CEBA9FB02BB5FFC8F49B3FEFE381BB1D3
Malicious:	false
Preview:	LPKSHHRH.................'.o.rO..........................................'.o.rO.................................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.6529251407736725
Encrypted:	false
SSDEEP:	24:tmi8AIp009AIE+6ZAIEINCAIbp8nAIF6ftAIFhOw9xInAI5V:tip00bE+6fEINsbpqkfLjz9Y5V
MD5:	2019E422A5A845572DB82ED7793D736E
SHA1:	E6F6615D5ADD017B488B5F6EC930C4CB1E1C2099
SHA-256:	396F76AF1F6547C5530A854702806D32BDC38200B71EB988FB59DAB784149A8D
SHA-512:	E075495C7798BC1C6E333649CC58AFE87DD907EC30A8B16ED26BF2DC6726510468BABD30E03080D02A346DA57FBBF8266B2184B429F92AD7619C07C2C8208D2C
Malicious:	false
Preview:	Jul 11 14:18:50 galassia kernel: [ 624.369803] New task spawned: old: (tgid 7163, tid 7163), new (tgid: 7164, tid: 7164).Jul 11 14:18:50 galassia kernel: [ 625.759411] New task spawned: old: (tgid 7165, tid 7165), new (tgid: 7165, tid: 7166).Jul 11 14:18:50 galassia kernel: [ 625.760244] New task spawned: old: (tgid 7165, tid 7165), new (tgid: 7165, tid: 7167).Jul 11 14:18:50 galassia kernel: [ 625.762720] New task spawned: old: (tgid 7165, tid 7166), new (tgid: 7165, tid: 7168).Jul 11 14:18:50 galassia kernel: [ 625.972569] New task spawned: old: (tgid 7127, tid 7127), new (tgid: 7169, tid: 7169).Jul 11 14:18:51 galassia kernel: [ 626.080945] New task spawned: old: (tgid 7127, tid 7127), new (tgid: 7171, tid: 7171).Jul 11 14:18:52 galassia kernel: [ 628.173750] New task spawned: old: (tgid 7173, tid 7173), new (tgid: 7173, tid: 7175).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	3914
Entropy (8bit):	5.0423537300268455
Encrypted:	false
SSDEEP:	96:mdRLeNBe+pzbmp9wt+7KgHvpJDx2PldI+U/:a1eNZgh+W
MD5:	EF064084F971E3C5B3C138575FE40125
SHA1:	B50C6EE624B6E458E15244BA6C6A1D7A6629AC31
SHA-256:	8977272A1DFD0CF3A898DAF21ADEF05CC9BDF89AFF54E8FF9A8B8F8D1CE5D3F2
SHA-512:	3ACFCE1B5CBFB68E75325FE6CA0DED4CE44BF43B16F085309573106D3CED547562F196F5EA847AD042E12613C0AB2AF03B534BEFEC3540005690D6C9BF33BD00
Malicious:	false
Preview:	Jul 11 14:18:49 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jul 11 14:18:49 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jul 11 14:18:49 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 7..Jul 11 14:18:49 galassia systemd[1]: Stopped System Logging Service..Jul 11 14:18:49 galassia systemd[1]: Starting System Logging Service....Jul 11 14:18:49 galassia gdm3: Couldn't get type for session 'c1': No such device or address.Jul 11 14:18:49 galassia /usr/lib/gdm3/gdm-wayland-session[7152]: Unable to register display with display manager.Jul 11 14:18:50 galassia kernel: [ 624.369803] New task spawned: old: (tgid 7163, tid 7163), new (tgid: 7164, tid: 7164).Jul 11 14:18:50 galassia kernel: [ 625.759411] New task spawned: old: (tgid 7165, tid 7165), new (tgid: 7165, tid: 7166).Jul 11 14:18:50 galassia kernel: [ 625.760244] New task spawned: old: (tgid 7165, tid 7165), new (tgid: 7165, tid: 7167)

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:Y0sXlXEWtl/CN/:YV+ylqN/
MD5:	351081F7BB6185172CBD7891B20FBBC1
SHA1:	D84F4058974E9A6C328550B85C42714A6F19DA98
SHA-256:	D9A6D7CA072B5A51D46DC6CE2D6245672985088C985A64FDF9F608F8B66A8774
SHA-512:	826F864DA077B6F897B9C628923A84138BAE42F66A9FA668365C5E5BD74BF226AECD1E9106EEE0FDD10F866815DA97291F749337D87CF99C5A9046FCB9792FB0
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................0.f.Q......................................

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.490347307081803
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	X2Yb9u8Ntz.elf
File size:	58'652 bytes
MD5:	57f7cd76662180c940fa3e47c9c53f1a
SHA1:	611feca3bee73372356b7be8c66265e0a0ddee36
SHA256:	20d61bf0abe931d3945947b09e1111b0b246000d7bb73535347cc2e3f04f8546
SHA512:	2e8fe40ed49c3b83113fd12d86d58470f6937e51321f9d827a66c4a3013eac662ef2f92777a41eab9b58ec712498cc5fe0396292337e38dc4be8fc2a6f0ebded
SSDEEP:	1536:T+aBMuFoUEgyFcZdSWY/aKVv76SXIVVSr:T+CMuFogyFcZdSWY/bVT6oIVIr
TLSH:	764328C4A6C3F9FADC11197C716AAF729E73E03BB135EE8AC3D915739911602910239E
File Content Preview:	.ELF....................d...4...........4. ...(..............................................r...r......<...........Q.td............................U..S.......;....h........[]...$.............U......=`s...t..5.....r......r......u........t....h.b..........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	58252
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xd126	0x0	0x6	AX	16
.fini	PROGBITS	0x80551d6	0xd1d6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8055200	0xd200	0x10c0	0x0	0x2	A	32
.ctors	PROGBITS	0x80572c4	0xe2c4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80572cc	0xe2cc	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80572e4	0xe2e4	0x68	0x0	0x3	WA	4
.bss	NOBITS	0x8057360	0xe34c	0x7a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xe34c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xe2c0	0xe2c0	6.5128	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xe2c4	0x80572c4	0x80572c4	0x88	0x83c	1.7570	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 11, 2024 21:16:20.470215082 CEST	192.168.2.23	8.8.8.8	0x6d91	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:16:20.470257998 CEST	192.168.2.23	8.8.8.8	0xe49e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:16:21.445907116 CEST	192.168.2.23	8.8.8.8	0xc61d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:17:39.255079985 CEST	192.168.2.23	8.8.8.8	0xe762	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:17:39.255079985 CEST	192.168.2.23	8.8.8.8	0x32c9	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:17:41.767919064 CEST	192.168.2.23	8.8.8.8	0xede5	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:17:56.186093092 CEST	192.168.2.23	8.8.8.8	0xcec4	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:18:05.254590034 CEST	192.168.2.23	8.8.8.8	0xc31	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:18:05.254638910 CEST	192.168.2.23	8.8.8.8	0x15a9	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:18:20.582449913 CEST	192.168.2.23	8.8.8.8	0x553c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:18:26.697282076 CEST	192.168.2.23	8.8.8.8	0x7fd2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jul 11, 2024 21:18:38.554169893 CEST	192.168.2.23	8.8.8.8	0x9240	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 11, 2024 21:16:20.912812948 CEST	8.8.8.8	192.168.2.23	0x6d91	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:16:20.912812948 CEST	8.8.8.8	192.168.2.23	0x6d91	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:17:39.728806019 CEST	8.8.8.8	192.168.2.23	0xe762	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Jul 11, 2024 21:17:39.728806019 CEST	8.8.8.8	192.168.2.23	0xe762	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-07-11 19:16:27 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-07-11 19:16:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-07-11 19:16:27 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-07-11 19:16:27 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 11 Jul 2024 19:16:27 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 970 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	19:15:42
Start date (UTC):	11/07/2024
Path:	/tmp/X2Yb9u8Ntz.elf
Arguments:	/tmp/X2Yb9u8Ntz.elf
File size:	58652 bytes
MD5 hash:	57f7cd76662180c940fa3e47c9c53f1a

Start time (UTC):	19:15:58
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:00
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:17
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:18
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:19
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:20
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:21
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:22
Start date (UTC):	11/07/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:16:23
Start date (UTC):	11/07/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:16:24
Start date (UTC):	11/07/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:16:25
Start date (UTC):	11/07/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:16:26
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report X2Yb9u8Ntz.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6517/oom_score_adj

/proc/7162/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75908EPphw7

/run/systemd/journal/streams/.#9:75909LUuYl5

/run/systemd/journal/streams/.#9:76898D6wfd5

/run/systemd/journal/streams/.#9:769425Lwuv5

/run/systemd/journal/streams/.#9:76957RDfIl5

/run/systemd/journal/streams/.#9:77033dHP6N6

/run/systemd/journal/streams/.#9:77036gCbIH4

/run/systemd/journal/streams/.#9:77158cOAI87

/run/systemd/journal/streams/.#9:77201CAgfa5

/run/systemd/journal/streams/.#9:77402n6gXw5

/run/systemd/journal/streams/.#9:77413rXpuz8

/run/systemd/journal/streams/.#9:77462HzarZ4

/run/systemd/journal/streams/.#9:77516NSewI8

/run/systemd/journal/streams/.#9:776483ILD64

/run/systemd/journal/streams/.#9:77681KYhuH7

/run/systemd/journal/streams/.#9:77683WrZvj8

/run/systemd/journal/streams/.#9:78476MPeUT7

/run/systemd/journal/streams/.#9:78477Ct9JW8

/run/systemd/journal/streams/.#9:79714nyyODO

/run/systemd/journal/streams/.#9:79796ssatNO

/run/systemd/journal/streams/.#9:79837VCjdCN

Linux Analysis Report
X2Yb9u8Ntz.elf

Start time (UTC):	19:16:28
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:38
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:16:39
Start date (UTC):	11/07/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:16:41
Start date (UTC):	11/07/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	19:16:42
Start date (UTC):	11/07/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	19:16:59
Start date (UTC):	11/07/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	19:17:35
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:17:36
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:17:37
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:17:40
Start date (UTC):	11/07/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75