Edit tour

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf

Overview

General Information

Sample name:	SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
Analysis ID:	1501010
MD5:	e65a9ede6db58e9ebf08694cd98f72e4
SHA1:	77c1172bbc46e10b084cfc3922bb8d57838d28c0
SHA256:	94f2fb819755ec3eaf44c3c74e570bc47fbfbfcee984db35376cd014219e517c
Tags:	elf
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample is packed with UPX

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "systemctl" command used for controlling the systemd system and service manager

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501010
Start date and time:	2024-08-29 08:42:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
Detection:	MAL
Classification:	mal88.spre.troj.evad.linELF@0/170@12/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
PID:	6212
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	sp00ky scary skeletons
Standard Error:

Process Tree

system is lnxubuntu20

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6212, Parent: 6132, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6214, Parent: 6212)

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6215, Parent: 6212)

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6216, Parent: 6212)

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6220, Parent: 6216)

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6223, Parent: 6216)

SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf New Fork (PID: 6226, Parent: 6216)

systemd New Fork (PID: 6239, Parent: 1)

journalctl (PID: 6239, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6255, Parent: 1)

systemd-journald (PID: 6255, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6261, Parent: 1)

journalctl (PID: 6261, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6278, Parent: 1)

dbus-daemon (PID: 6278, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6308, Parent: 1860)

pulseaudio (PID: 6308, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6311, Parent: 1)

rtkit-daemon (PID: 6311, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6314, Parent: 1)

systemd-logind (PID: 6314, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6378, Parent: 1)

polkitd (PID: 6378, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6383, Parent: 1)

agetty (PID: 6383, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6384, Parent: 1320)

Default (PID: 6384, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6385, Parent: 1320)

Default (PID: 6385, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6386, Parent: 1320)

Default (PID: 6386, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6387, Parent: 1)

rsyslogd (PID: 6387, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6388, Parent: 1)

gpu-manager (PID: 6388, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6392, Parent: 6388)

sh (PID: 6392, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6393, Parent: 6392)

grep (PID: 6393, Parent: 6392, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6394, Parent: 6388)

sh (PID: 6394, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6395, Parent: 6394)

grep (PID: 6395, Parent: 6394, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6396, Parent: 6388)

sh (PID: 6396, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6397, Parent: 6396)

grep (PID: 6397, Parent: 6396, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6399, Parent: 6388)

sh (PID: 6399, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6401, Parent: 6388)

sh (PID: 6401, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6402, Parent: 6401)

grep (PID: 6402, Parent: 6401, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6403, Parent: 6388)

sh (PID: 6403, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6405, Parent: 6403)

grep (PID: 6405, Parent: 6403, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6406, Parent: 6388)

sh (PID: 6406, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6407, Parent: 6406)

grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6408, Parent: 6388)

sh (PID: 6408, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6408)

grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6413, Parent: 1)

generate-config (PID: 6413, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6414, Parent: 6413)

pkill (PID: 6414, Parent: 6413, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6415, Parent: 1)

gdm-wait-for-drm (PID: 6415, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6421, Parent: 1)

gdm3 (PID: 6421, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6426, Parent: 6421)

plymouth (PID: 6426, Parent: 6421, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6442, Parent: 6421)

gdm-session-worker (PID: 6442, Parent: 6421, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6448, Parent: 6442)

gdm-wayland-session (PID: 6448, Parent: 6442, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6450, Parent: 6448)

dbus-daemon (PID: 6450, Parent: 6448, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6452, Parent: 6450)

dbus-daemon New Fork (PID: 6453, Parent: 6452)

false (PID: 6453, Parent: 6452, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6454, Parent: 6448)

dbus-run-session (PID: 6454, Parent: 6448, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6455, Parent: 6454)

dbus-daemon (PID: 6455, Parent: 6454, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6456, Parent: 6421)

Default (PID: 6456, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6457, Parent: 6421)

Default (PID: 6457, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6427, Parent: 1)

accounts-daemon (PID: 6427, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6437, Parent: 6427)

language-validate (PID: 6437, Parent: 6427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6438, Parent: 6437)

language-options (PID: 6438, Parent: 6437, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6439, Parent: 6438)

sh (PID: 6439, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6440, Parent: 6439)

locale (PID: 6440, Parent: 6439, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6441, Parent: 6439)

grep (PID: 6441, Parent: 6439, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6471, Parent: 2038)

fusermount (PID: 6471, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6492, Parent: 1)

journalctl (PID: 6492, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6493, Parent: 1)

systemd-journald (PID: 6493, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6494, Parent: 1)

dbus-daemon (PID: 6494, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6502, Parent: 1)

systemd-logind (PID: 6502, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6561, Parent: 1)

gpu-manager (PID: 6561, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6562, Parent: 6561)

sh (PID: 6562, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6563, Parent: 6562)

grep (PID: 6563, Parent: 6562, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6564, Parent: 6561)

sh (PID: 6564, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6565, Parent: 6564)

grep (PID: 6565, Parent: 6564, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6566, Parent: 6561)

sh (PID: 6566, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6567, Parent: 6566)

grep (PID: 6567, Parent: 6566, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6568, Parent: 6561)

sh (PID: 6568, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6569, Parent: 6568)

grep (PID: 6569, Parent: 6568, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6570, Parent: 6561)

sh (PID: 6570, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6571, Parent: 6570)

grep (PID: 6571, Parent: 6570, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6572, Parent: 6561)

sh (PID: 6572, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6573, Parent: 6572)

grep (PID: 6573, Parent: 6572, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6575, Parent: 6561)

sh (PID: 6575, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6576, Parent: 6575)

grep (PID: 6576, Parent: 6575, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6578, Parent: 6561)

sh (PID: 6578, Parent: 6561, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6579, Parent: 6578)

grep (PID: 6579, Parent: 6578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6574, Parent: 1)

journalctl (PID: 6574, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6582, Parent: 1)

generate-config (PID: 6582, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6583, Parent: 6582)

pkill (PID: 6583, Parent: 6582, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6584, Parent: 1)

agetty (PID: 6584, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6585, Parent: 1)

gdm-wait-for-drm (PID: 6585, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6586, Parent: 1)

rsyslogd (PID: 6586, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6590, Parent: 1)

journalctl (PID: 6590, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6593, Parent: 1)

systemd-journald (PID: 6593, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6594, Parent: 1)

journalctl (PID: 6594, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6598, Parent: 1)

gdm3 (PID: 6598, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6601, Parent: 6598)

plymouth (PID: 6601, Parent: 6598, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

systemd New Fork (PID: 6602, Parent: 1)

accounts-daemon (PID: 6602, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6606, Parent: 6602)

language-validate (PID: 6606, Parent: 6602, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6607, Parent: 6606)

language-options (PID: 6607, Parent: 6606, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6608, Parent: 6607)

sh (PID: 6608, Parent: 6607, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6609, Parent: 6608)

locale (PID: 6609, Parent: 6608, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6610, Parent: 6608)

grep (PID: 6610, Parent: 6608, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6613, Parent: 1)

dbus-daemon (PID: 6613, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6614, Parent: 1)

gpu-manager (PID: 6614, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6615, Parent: 6614)

sh (PID: 6615, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6616, Parent: 6615)

grep (PID: 6616, Parent: 6615, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6617, Parent: 6614)

sh (PID: 6617, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6618, Parent: 6617)

grep (PID: 6618, Parent: 6617, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6619, Parent: 6614)

sh (PID: 6619, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6621, Parent: 6619)

grep (PID: 6621, Parent: 6619, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6681, Parent: 6614)

sh (PID: 6681, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6683, Parent: 6681)

grep (PID: 6683, Parent: 6681, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6684, Parent: 6614)

sh (PID: 6684, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6686, Parent: 6684)

grep (PID: 6686, Parent: 6684, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6687, Parent: 6614)

sh (PID: 6687, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6688, Parent: 6687)

grep (PID: 6688, Parent: 6687, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6689, Parent: 6614)

sh (PID: 6689, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6690, Parent: 6689)

grep (PID: 6690, Parent: 6689, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6691, Parent: 6614)

sh (PID: 6691, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6692, Parent: 6691)

grep (PID: 6692, Parent: 6691, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6624, Parent: 1)

systemd-logind (PID: 6624, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6695, Parent: 1)

agetty (PID: 6695, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6696, Parent: 1)

generate-config (PID: 6696, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6697, Parent: 6696)

pkill (PID: 6697, Parent: 6696, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6698, Parent: 1)

rsyslogd (PID: 6698, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6699, Parent: 1)

gdm-wait-for-drm (PID: 6699, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6703, Parent: 1)

journalctl (PID: 6703, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6704, Parent: 1)

systemd-journald (PID: 6704, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6706, Parent: 1)

journalctl (PID: 6706, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6712, Parent: 1)

gdm3 (PID: 6712, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6715, Parent: 6712)

plymouth (PID: 6715, Parent: 6712, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

systemd New Fork (PID: 6716, Parent: 1)

accounts-daemon (PID: 6716, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6720, Parent: 6716)

language-validate (PID: 6720, Parent: 6716, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6721, Parent: 6720)

language-options (PID: 6721, Parent: 6720, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6722, Parent: 6721)

sh (PID: 6722, Parent: 6721, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6723, Parent: 6722)

locale (PID: 6723, Parent: 6722, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6724, Parent: 6722)

grep (PID: 6724, Parent: 6722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6726, Parent: 1)

polkitd (PID: 6726, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6734, Parent: 1)

dbus-daemon (PID: 6734, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6737, Parent: 1)

systemd-logind (PID: 6737, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6794, Parent: 1)

gpu-manager (PID: 6794, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6795, Parent: 6794)

sh (PID: 6795, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6796, Parent: 6795)

grep (PID: 6796, Parent: 6795, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6797, Parent: 6794)

sh (PID: 6797, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6798, Parent: 6797)

grep (PID: 6798, Parent: 6797, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6799, Parent: 6794)

sh (PID: 6799, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6800, Parent: 6799)

grep (PID: 6800, Parent: 6799, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6801, Parent: 6794)

sh (PID: 6801, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6802, Parent: 6801)

grep (PID: 6802, Parent: 6801, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6803, Parent: 6794)

sh (PID: 6803, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6804, Parent: 6803)

grep (PID: 6804, Parent: 6803, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6807, Parent: 6794)

sh (PID: 6807, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6808, Parent: 6807)

grep (PID: 6808, Parent: 6807, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6810, Parent: 6794)

sh (PID: 6810, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6811, Parent: 6810)

grep (PID: 6811, Parent: 6810, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6812, Parent: 6794)

sh (PID: 6812, Parent: 6794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6813, Parent: 6812)

grep (PID: 6813, Parent: 6812, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6809, Parent: 1)

agetty (PID: 6809, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6814, Parent: 1)

generate-config (PID: 6814, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6815, Parent: 6814)

pkill (PID: 6815, Parent: 6814, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6816, Parent: 1)

rsyslogd (PID: 6816, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6820, Parent: 1)

journalctl (PID: 6820, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6821, Parent: 1)

gdm-wait-for-drm (PID: 6821, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6822, Parent: 1)

systemd-journald (PID: 6822, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6825, Parent: 1)

journalctl (PID: 6825, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6829, Parent: 1)

gdm3 (PID: 6829, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6832, Parent: 6829)

plymouth (PID: 6832, Parent: 6829, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6846, Parent: 6829)

gdm-session-worker (PID: 6846, Parent: 6829, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6854, Parent: 6846)

gdm-wayland-session (PID: 6854, Parent: 6846, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6858, Parent: 6854)

dbus-daemon (PID: 6858, Parent: 6854, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6861, Parent: 6858)

dbus-daemon New Fork (PID: 6862, Parent: 6861)

false (PID: 6862, Parent: 6861, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6863, Parent: 6854)

dbus-run-session (PID: 6863, Parent: 6854, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6866, Parent: 6863)

dbus-daemon (PID: 6866, Parent: 6863, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6869, Parent: 6829)

Default (PID: 6869, Parent: 6829, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6870, Parent: 6829)

Default (PID: 6870, Parent: 6829, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6833, Parent: 1)

accounts-daemon (PID: 6833, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6837, Parent: 6833)

language-validate (PID: 6837, Parent: 6833, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6838, Parent: 6837)

language-options (PID: 6838, Parent: 6837, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6839, Parent: 6838)

sh (PID: 6839, Parent: 6838, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6840, Parent: 6839)

locale (PID: 6840, Parent: 6839, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6841, Parent: 6839)

grep (PID: 6841, Parent: 6839, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6842, Parent: 1)

polkitd (PID: 6842, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6852, Parent: 1)

systemd (PID: 6852, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6855, Parent: 6852)

systemd New Fork (PID: 6857, Parent: 6855)

30-systemd-environment-d-generator (PID: 6857, Parent: 6855, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6939, Parent: 6852)

systemctl (PID: 6939, Parent: 6852, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6941, Parent: 6852)

pulseaudio (PID: 6941, Parent: 6852, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6865, Parent: 1860)

dbus-daemon (PID: 6865, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6875, Parent: 1)

dbus-daemon (PID: 6875, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6879, Parent: 1)

systemd-logind (PID: 6879, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6940, Parent: 1)

agetty (PID: 6940, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6944, Parent: 1)

rsyslogd (PID: 6944, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6945, Parent: 1)

rtkit-daemon (PID: 6945, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6951, Parent: 1)

polkitd (PID: 6951, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6955, Parent: 1)

gpu-manager (PID: 6955, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6956, Parent: 6955)

sh (PID: 6956, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6957, Parent: 6956)

grep (PID: 6957, Parent: 6956, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6959, Parent: 6955)

sh (PID: 6959, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6960, Parent: 6959)

grep (PID: 6960, Parent: 6959, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6961, Parent: 6955)

sh (PID: 6961, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6963, Parent: 6961)

grep (PID: 6963, Parent: 6961, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6964, Parent: 6955)

sh (PID: 6964, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6965, Parent: 6964)

grep (PID: 6965, Parent: 6964, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6966, Parent: 6955)

sh (PID: 6966, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6967, Parent: 6966)

grep (PID: 6967, Parent: 6966, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6968, Parent: 6955)

sh (PID: 6968, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6969, Parent: 6968)

grep (PID: 6969, Parent: 6968, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6970, Parent: 6955)

sh (PID: 6970, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6971, Parent: 6970)

grep (PID: 6971, Parent: 6970, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6972, Parent: 6955)

sh (PID: 6972, Parent: 6955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6973, Parent: 6972)

grep (PID: 6973, Parent: 6972, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6958, Parent: 1)

journalctl (PID: 6958, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6962, Parent: 1)

systemd-journald (PID: 6962, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6976, Parent: 1)

generate-config (PID: 6976, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6977, Parent: 6976)

pkill (PID: 6977, Parent: 6976, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6979, Parent: 1)

gdm-wait-for-drm (PID: 6979, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6980, Parent: 1)

journalctl (PID: 6980, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6986, Parent: 1)

dbus-daemon (PID: 6986, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6993, Parent: 1)

systemd-logind (PID: 6993, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7051, Parent: 1)

gdm3 (PID: 7051, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7054, Parent: 7051)

plymouth (PID: 7054, Parent: 7051, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7075, Parent: 7051)

gdm-session-worker (PID: 7075, Parent: 7051, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

systemd New Fork (PID: 7055, Parent: 1)

agetty (PID: 7055, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7056, Parent: 1)

accounts-daemon (PID: 7056, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7062, Parent: 7056)

language-validate (PID: 7062, Parent: 7056, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7063, Parent: 7062)

language-options (PID: 7063, Parent: 7062, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7064, Parent: 7063)

sh (PID: 7064, Parent: 7063, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7065, Parent: 7064)

locale (PID: 7065, Parent: 7064, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7066, Parent: 7064)

grep (PID: 7066, Parent: 7064, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7067, Parent: 1)

polkitd (PID: 7067, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7068, Parent: 1)

rsyslogd (PID: 7068, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12070:$x1: POST /cdn-cgi/ 0x12494:$s1: LCOGQGPTGP
6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12070:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12070:$x1: POST /cdn-cgi/ 0x12494:$s1: LCOGQGPTGP
6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12070:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12070:$x1: POST /cdn-cgi/ 0x12494:$s1: LCOGQGPTGP
6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12070:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12070:$x1: POST /cdn-cgi/ 0x12494:$s1: LCOGQGPTGP
6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12070:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6212	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6215	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6226	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 14 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	ReversingLabs: Detection: 65%
Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	Virustotal: Detection: 38%			Perma Link

Source: /usr/bin/pulseaudio (PID: 6308)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6414)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6583)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6697)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6815)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6941)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6977)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: global traffic

TCP traffic: 192.168.2.23:60334 -> 154.197.69.149:81

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6387)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6586)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6816)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6944)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7068)	Reads hosts file: /etc/hosts

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6214)	Socket: 0.0.0.0:23	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6214)	Socket: 0.0.0.0:0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6214)	Socket: 0.0.0.0:80	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	Socket: 0.0.0.0:0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	Socket: 0.0.0.0:80	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6421)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6450)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6704)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6822)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6829)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6858)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6852)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6962)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7051)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 154.197.69.149
Source: unknown	TCP traffic detected without corresponding DNS query: 154.197.69.149
Source: unknown	TCP traffic detected without corresponding DNS query: 154.197.69.149
Source: unknown	TCP traffic detected without corresponding DNS query: 219.135.213.169
Source: unknown	TCP traffic detected without corresponding DNS query: 193.132.51.169
Source: unknown	TCP traffic detected without corresponding DNS query: 9.135.27.227
Source: unknown	TCP traffic detected without corresponding DNS query: 190.0.129.175
Source: unknown	TCP traffic detected without corresponding DNS query: 243.253.28.238
Source: unknown	TCP traffic detected without corresponding DNS query: 100.221.93.223
Source: unknown	TCP traffic detected without corresponding DNS query: 133.250.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 14.68.150.134
Source: unknown	TCP traffic detected without corresponding DNS query: 252.36.87.170
Source: unknown	TCP traffic detected without corresponding DNS query: 67.223.182.64
Source: unknown	TCP traffic detected without corresponding DNS query: 136.69.165.209
Source: unknown	TCP traffic detected without corresponding DNS query: 108.228.209.241
Source: unknown	TCP traffic detected without corresponding DNS query: 182.239.111.234
Source: unknown	TCP traffic detected without corresponding DNS query: 250.137.244.254
Source: unknown	TCP traffic detected without corresponding DNS query: 153.76.228.181
Source: unknown	TCP traffic detected without corresponding DNS query: 219.247.90.103
Source: unknown	TCP traffic detected without corresponding DNS query: 243.7.245.45
Source: unknown	TCP traffic detected without corresponding DNS query: 207.142.3.32
Source: unknown	TCP traffic detected without corresponding DNS query: 103.247.83.55
Source: unknown	TCP traffic detected without corresponding DNS query: 24.153.197.163
Source: unknown	TCP traffic detected without corresponding DNS query: 179.38.83.190
Source: unknown	TCP traffic detected without corresponding DNS query: 54.127.3.31
Source: unknown	TCP traffic detected without corresponding DNS query: 221.24.218.108
Source: unknown	TCP traffic detected without corresponding DNS query: 126.111.205.76
Source: unknown	TCP traffic detected without corresponding DNS query: 169.223.54.153
Source: unknown	TCP traffic detected without corresponding DNS query: 108.179.102.57
Source: unknown	TCP traffic detected without corresponding DNS query: 121.221.55.130
Source: unknown	TCP traffic detected without corresponding DNS query: 142.58.30.246
Source: unknown	TCP traffic detected without corresponding DNS query: 86.252.124.79
Source: unknown	TCP traffic detected without corresponding DNS query: 175.14.27.117
Source: unknown	TCP traffic detected without corresponding DNS query: 167.74.188.218
Source: unknown	TCP traffic detected without corresponding DNS query: 83.48.197.31
Source: unknown	TCP traffic detected without corresponding DNS query: 165.39.129.112
Source: unknown	TCP traffic detected without corresponding DNS query: 247.20.5.111
Source: unknown	TCP traffic detected without corresponding DNS query: 71.63.18.69
Source: unknown	TCP traffic detected without corresponding DNS query: 171.198.39.14
Source: unknown	TCP traffic detected without corresponding DNS query: 145.90.243.60
Source: unknown	TCP traffic detected without corresponding DNS query: 202.254.9.83
Source: unknown	TCP traffic detected without corresponding DNS query: 191.127.186.142
Source: unknown	TCP traffic detected without corresponding DNS query: 100.244.193.248
Source: unknown	TCP traffic detected without corresponding DNS query: 221.125.247.24
Source: unknown	TCP traffic detected without corresponding DNS query: 203.154.21.217
Source: unknown	TCP traffic detected without corresponding DNS query: 254.218.187.4
Source: unknown	TCP traffic detected without corresponding DNS query: 89.129.38.213
Source: unknown	TCP traffic detected without corresponding DNS query: 68.141.167.16
Source: unknown	TCP traffic detected without corresponding DNS query: 89.11.103.248
Source: unknown	TCP traffic detected without corresponding DNS query: 48.100.64.120

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	String found in binary or memory: http://upx.sf.net
Source: syslog.467.dr, syslog.389.dr, syslog.177.dr, syslog.321.dr, syslog.247.dr, syslog.46.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38352
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6214)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6043, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6494, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6586, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6695, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6704, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6816, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6852, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6875, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6940, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6944, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6214)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6043, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6494, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6586, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6695, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6704, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6816, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6852, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6875, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6940, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6220)	SIGKILL sent: pid: 6944, result: successful	Jump to behavior

Source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal88.spre.troj.evad.linELF@0/170@12/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6278)	File: /proc/6278/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6450)	File: /proc/6450/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6455)	File: /proc/6455/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6471)	File: /proc/6471/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6494)	File: /proc/6494/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6613)	File: /proc/6613/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6734)	File: /proc/6734/mounts
Source: /usr/bin/dbus-daemon (PID: 6858)	File: /proc/6858/mounts
Source: /usr/bin/dbus-daemon (PID: 6866)	File: /proc/6866/mounts
Source: /usr/bin/dbus-daemon (PID: 6865)	File: /proc/6865/mounts
Source: /usr/bin/dbus-daemon (PID: 6875)	File: /proc/6875/mounts
Source: /usr/bin/dbus-daemon (PID: 6986)	File: /proc/6986/mounts

Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:755236mKsBc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:755244sjdn9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:75869KpdN2b	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:75903xY8ec9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:75914jNVOhc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:759216KWSSb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:75923MBsj48	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:76984v1LJI8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:762030eQb98	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:763286aAPyc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:7636345Anx9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:77502GCr2ub	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:77505cqgl1a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:77676p7hWRa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:77685nAFVHb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:77806aqt2V8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:78875zBz1h9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:78877XNeJha	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:78918g9Bw38	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	File: /run/systemd/journal/streams/.#9:78920Ibnd1b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/seats/.#seat0O7cdpD	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/users/.#1274tPoKB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/users/.#127aBRryB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/seats/.#seat0GZOSoB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/users/.#127ML1rhB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/users/.#127zEMjKC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6314)	File: /run/systemd/users/.#127Bd7Q1B	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6378)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6448)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:78674YXQNl8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:78675ReDkN8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:786833JVSz8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:78691cBJ89b	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:786924WjXl8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:78703WcyFk9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	File: /run/systemd/journal/streams/.#9:78710yGLSNc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6502)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6502)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6502)	File: /run/systemd/seats/.#seat0wxI9CR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:800328YkRJL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80033dBtcoL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80034r3r0eH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80116TOqyPH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80207gDmaUJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80312OBCzlI	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80343BNzkgH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80912qj26UJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80925lll6oI	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File: /run/systemd/journal/streams/.#9:80933e9oKiJ	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6602)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6624)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6624)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6624)	File: /run/systemd/seats/.#seat00E54R4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:81030CHGz86
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:81031JZCFN6
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82036lQQIX6
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82042RNlrW6
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82139SIjXr7
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82242mlW3E5
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82249oLNai6
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82370MnveF7
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:82443tZvWs6
Source: /lib/systemd/systemd-journald (PID: 6704)	File: /run/systemd/journal/streams/.#9:81386WEyBD7
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6716)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6726)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6737)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6737)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6737)	File: /run/systemd/seats/.#seat0HHPrQA
Source: /lib/systemd/systemd-logind (PID: 6737)	File: /run/systemd/users/.#127X7v0cE
Source: /lib/systemd/systemd-logind (PID: 6737)	File: /run/systemd/users/.#127xXPIjB
Source: /lib/systemd/systemd-logind (PID: 6737)	File: /run/systemd/seats/.#seat0K0pVeC
Source: /lib/systemd/systemd-logind (PID: 6737)	File: /run/systemd/users/.#127IvAfqB
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:82879AjOg72
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:82880Hs8lm2
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:82881bduZ14
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:82887pwbg54
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81653Ej2U83
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:816568eMyN0
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81663smsGL2
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:816821JgyM1
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:816838I0a73
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81705dRNjX0
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81706eToRs2
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81707XjCJO3
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81812FE5FQ2
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:81859G42ic4
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83525csLSL1
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83526qGHdZ2
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:835290S6Px1
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83561lZvAZ1
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83599mm3C13
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83678n4u1l3
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:844151rQ1C4
Source: /lib/systemd/systemd-journald (PID: 6822)	File: /run/systemd/journal/streams/.#9:83789wvvF41
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6854)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6833)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6833)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6842)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6852)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6857)	Directory: <invalid fd (4)>/.config
Source: /lib/systemd/systemd-logind (PID: 6879)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6879)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6879)	File: /run/systemd/seats/.#seat0Sy6mBn
Source: /usr/lib/policykit-1/polkitd (PID: 6951)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:84783zMQqMC
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:84784oPrrdE
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:84785XWlh4B
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:84786uekhYE
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85192EXhuiC
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85199dmVksF
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85266T3PJQD
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85290HzuvxE
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85312uBjfQD
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85397GsCXrF
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:85506s8A1PB
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:8555763ELBF
Source: /lib/systemd/systemd-journald (PID: 6962)	File: /run/systemd/journal/streams/.#9:855590z5ELD
Source: /lib/systemd/systemd-logind (PID: 6993)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6993)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6993)	File: /run/systemd/seats/.#seat0b4vm7W
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7056)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7067)	Directory: /root/.cache

Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6593/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6494/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6698/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6598/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/environ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sched	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/658/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6611/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6602/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	File opened: /proc/6613/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6392)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6394)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6396)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6401)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6403)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6439)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6562)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6564)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6566)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6568)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6570)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6575)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6578)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6608)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6615)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6617)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6619)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6681)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6684)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6687)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6689)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6691)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6722)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6795)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6797)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6799)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6801)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6803)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6807)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6810)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6812)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6839)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6956)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6959)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6961)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6964)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6966)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6968)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6970)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6972)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7064)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6393)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6395)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6397)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6402)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6405)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6407)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6441)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6563)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6565)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6567)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6569)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6573)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6576)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6579)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6610)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6616)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6618)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6621)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6683)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6686)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6688)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6690)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6692)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6724)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6796)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6798)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6800)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6802)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6804)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6808)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6811)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6813)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6841)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6957)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6960)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6963)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6965)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6967)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6969)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6971)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6973)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7066)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6414)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6583)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6697)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6815)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6977)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd (PID: 6939)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /lib/systemd/systemd-journald (PID: 6255)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6704)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6822)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6962)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6383)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6584)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6695)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6809)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6940)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7055)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6421)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6421)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6598)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6598)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6602)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6602)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6712)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6712)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6716)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6716)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 6829)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6829)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6833)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6833)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7051)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7051)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7056)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7056)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6388)	Log file created: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6561)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6586)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6586)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6614)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6698)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6698)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6794)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6816)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6816)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6944)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6944)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6955)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7068)	Log file created: /var/log/kern.log	Jump to dropped file

Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf

Submission file: segment LOAD with 7.8954 entropy (max. 8.0)

Source: /usr/bin/gpu-manager (PID: 6388)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6561)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6614)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6794)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6955)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pulseaudio (PID: 6308)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6414)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6583)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6697)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6815)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6941)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6977)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf (PID: 6212)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6255)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6308)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6383)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6388)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6442)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6561)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6584)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6586)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6593)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6614)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6695)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6704)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6794)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6809)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6816)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6822)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6846)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6941)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6940)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6944)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6955)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6962)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7075)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7055)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7068)	Queries kernel information via 'uname':

Source: syslog.321.dr	Binary or memory string: Aug 29 01:45:38 galassia kernel: [ 579.320763] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6212.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6215.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6223.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6226.1.000055853896b000.00005585389f2000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6212.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6215.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6223.1.000055853896b000.00005585389f2000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6226.1.000055853896b000.00005585389f2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6212.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6215.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6223.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6226.1.00007ffc68654000.00007ffc68675000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6212.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6215.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6223.1.00007ffc68654000.00007ffc68675000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf, 6226.1.00007ffc68654000.00007ffc68675000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: syslog.321.dr	Binary or memory string: Aug 29 01:45:38 galassia kernel: [ 579.320732] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6602)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6716)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6833)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7056)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6215, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6226, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6215.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6212.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6223.1.00007f5d10400000.00007f5d10413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6215, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf PID: 6226, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	66%	ReversingLabs	Linux.Trojan.Multiverze
SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	39%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.rsyslog.com	0%	Avira URL Cloud	safe
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	0%	Avira URL Cloud	safe
https://www.rsyslog.com	0%	Virustotal		Browse
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.467.dr, syslog.389.dr, syslog.177.dr, syslog.321.dr, syslog.247.dr, syslog.46.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf	true	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
153.0.234.154	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
148.99.188.193	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
27.9.91.47	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
104.49.83.66	unknown	United States	7018	ATT-INTERNET4US	false
247.235.132.71	unknown	Reserved	unknown	unknown	false
220.26.44.133	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
89.164.44.26	unknown	Croatia (LOCAL Name: Hrvatska)	13046	ASN-ISKONHEPHR	false
39.8.197.191	unknown	Taiwan; Republic of China (ROC)	9674	FET-TWFarEastToneTelecommunicationCoLtdTW	false
42.228.86.234	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
90.32.225.239	unknown	France	3215	FranceTelecom-OrangeFR	false
176.104.173.201	unknown	Ukraine	57659	ASDINASNETUARodinskoeDonetskOblastUkraineUA	false
42.59.211.165	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
36.219.124.188	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
34.163.24.239	unknown	United States	2686	ATGS-MMD-ASUS	false
141.190.122.253	unknown	United States	1600	DNIC-ASBLK-01550-01601US	false
75.217.20.73	unknown	United States	22394	CELLCOUS	false
67.68.142.245	unknown	Canada	577	BACOMCA	false
107.46.12.161	unknown	United States	16567	NETRIX-16567US	false
40.166.158.254	unknown	United States	4249	LILLY-ASUS	false
147.59.130.139	unknown	United States	1533	DNIC-AS-01533US	false
117.31.131.142	unknown	China	133776	CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN	false
88.223.90.192	unknown	Lithuania	39354	INIT-MGNT-LT	false
91.74.182.176	unknown	United Arab Emirates	15802	DU-AS1AE	false
82.225.32.201	unknown	France	12322	PROXADFR	false
163.130.203.14	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
122.243.110.202	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
220.14.5.27	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
46.184.196.17	unknown	Bahrain	51375	VIVABH	false
82.115.111.102	unknown	Germany	12360	KTKKEVAGTelekomGmbHDE	false
144.28.149.168	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
217.73.72.150	unknown	United Kingdom	16238	TELECOM2-ASGB	false
44.153.254.45	unknown	United States	62383	LDS-ASBE	false
70.175.160.37	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
23.175.182.5	unknown	Reserved	6939	HURRICANEUS	false
172.97.50.35	unknown	Canada	53913	CITY-WIDE-COMMUNICATIONSCA	false
118.1.134.70	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.96.225.123	unknown	South Africa	3741	ISZA	false
197.33.61.232	unknown	Egypt	8452	TE-ASTE-ASEG	false
208.225.249.60	unknown	United States	4208	THE-ISERV-COMPANYUS	false
110.98.100.213	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
125.223.124.146	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
136.163.23.49	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
16.218.88.188	unknown	United States	unknown	unknown	false
101.154.252.84	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
36.0.152.193	unknown	China	2686	ATGS-MMD-ASUS	false
122.202.143.13	unknown	Korea Republic of	9946	CABLENET-AS-KRKCTVJEJUBROADCASTINGKR	false
65.67.19.208	unknown	United States	7018	ATT-INTERNET4US	false
4.221.81.172	unknown	United States	3356	LEVEL3US	false
83.236.222.171	unknown	Germany	20676	PLUSNETDE	false
43.231.50.131	unknown	India	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
114.3.173.12	unknown	Indonesia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
79.4.178.54	unknown	Italy	3269	ASN-IBSNAZIT	false
69.25.186.70	unknown	United States	27229	WEBHOST-ASN1US	false
12.105.103.32	unknown	United States	7018	ATT-INTERNET4US	false
194.144.254.166	unknown	Iceland	12969	VODAFONE_ICELANDIS	false
148.110.178.200	unknown	Luxembourg	7834	L3HARRIS-TECHNOLOGIESUS	false
144.41.184.52	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
170.5.174.206	unknown	United States	7726	FITC-ASUS	false
71.65.202.252	unknown	United States	11426	TWC-11426-CAROLINASUS	false
70.218.245.142	unknown	United States	22394	CELLCOUS	false
70.95.96.210	unknown	United States	20001	TWC-20001-PACWESTUS	false
67.26.220.208	unknown	United States	202818	LEVEL3COMMUNICATIONSFR	false
190.194.1.14	unknown	Argentina	10481	TelecomArgentinaSAAR	false
151.12.98.51	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
147.167.115.136	unknown	Switzerland	1452	DNIC-ASBLK-01451-01456US	false
255.234.110.63	unknown	Reserved	unknown	unknown	false
170.123.173.26	unknown	United States	54314	LHA-2-ASNUS	false
251.124.182.199	unknown	Reserved	unknown	unknown	false
78.26.183.213	unknown	Ukraine	34187	RENOME-ASUA	false
160.8.80.250	unknown	Sweden	14340	SALESFORCEUS	false
4.136.84.211	unknown	United States	3356	LEVEL3US	false
125.58.151.150	unknown	China	17968	DQTNETDaqingzhongjipetroleumtelecommunicationconstructi	false
241.170.198.199	unknown	Reserved	unknown	unknown	false
76.82.214.176	unknown	United States	20001	TWC-20001-PACWESTUS	false
5.87.207.95	unknown	Italy	24608	WINDTRE-ASIT	false
218.1.42.72	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
34.30.171.227	unknown	United States	2686	ATGS-MMD-ASUS	false
60.218.67.192	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
82.38.246.4	unknown	United Kingdom	5089	NTLGB	false
242.152.83.28	unknown	Reserved	unknown	unknown	false
115.187.17.191	unknown	unknown	38616	WORLDCALL-AS-KHIWorldcallTelecomLimitedPK	false
119.77.10.145	unknown	Australia	17918	AC3-AS-APac3AustralianCentreforAdvancedComputingand	false
181.15.249.101	unknown	Argentina	7303	TelecomArgentinaSAAR	false
102.88.122.146	unknown	Nigeria	37075	ZAINUGASUG	false
45.27.75.68	unknown	United States	7018	ATT-INTERNET4US	false
102.4.59.202	unknown	unknown	36926	CKL1-ASNKE	false
209.120.166.200	unknown	United States	3257	GTT-BACKBONEGTTDE	false
43.74.235.61	unknown	Japan	4249	LILLY-ASUS	false
93.224.218.30	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
191.28.242.114	unknown	Brazil	26599	TELEFONICABRASILSABR	false
107.218.72.218	unknown	United States	7018	ATT-INTERNET4US	false
126.167.132.159	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
173.124.105.247	unknown	United States	10507	SPCSUS	false
46.70.229.76	unknown	Armenia	12297	ARMENTELRepublicofArmeniaAM	false
169.231.214.64	unknown	United States	131	UCSB-NET-ASUS	false
169.164.103.55	unknown	United States	37611	AfrihostZA	false
93.115.182.12	unknown	United Kingdom	8530	EXCELLGB	false
66.50.253.170	unknown	Puerto Rico	10396	COQUI-NETPR	false
221.220.146.236	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
172.45.54.194	unknown	United States	21928	T-MOBILE-AS21928US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.74.182.176	x86	Get hash	malicious	Mirai	Browse
163.130.203.14	bnNLsZqj8B.elf	Get hash	malicious	Mirai	Browse
46.184.196.17	SpsdYiAti9.elf	Get hash	malicious	Mirai	Browse
197.96.225.123	bok.x86-20230315-2115.elf	Get hash	malicious	Mirai	Browse
	arm7	Get hash	malicious	Mirai	Browse
	HoGxvkYZd5	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hmips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	1CbMtpPRrp.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	SecuriteInfo.com.Android.Triada.4216.29660.4340.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	SecuriteInfo.com.Android.DownLoader.4879.1942.30074.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	SecuriteInfo.com.Trojan-Spy.AndroidOS.Joker.6571.5312.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	rebirth.i686.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	rebirth.mips.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	http://hcmexelatech.com	Get hash	malicious	Unknown	Browse	61.163.8.224
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	112.225.200.171
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	123.58.130.198
	sora.spc.elf	Get hash	malicious	Unknown	Browse	175.150.23.31
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	220.201.190.34
	sora.arm.elf	Get hash	malicious	Unknown	Browse	119.116.113.153
	sora.x86.elf	Get hash	malicious	Unknown	Browse	1.189.204.127
	https://web.safecity.com/backup_sql/databases/china/index.php?mc_phishing_protection_id=28398-cr2s30bjhva80uk6hku0	Get hash	malicious	Unknown	Browse	211.91.65.194
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	113.7.204.134
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	175.160.12.112
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	http://hcmexelatech.com	Get hash	malicious	Unknown	Browse	61.163.8.224
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	112.225.200.171
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	123.58.130.198
	sora.spc.elf	Get hash	malicious	Unknown	Browse	175.150.23.31
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	220.201.190.34
	sora.arm.elf	Get hash	malicious	Unknown	Browse	119.116.113.153
	sora.x86.elf	Get hash	malicious	Unknown	Browse	1.189.204.127
	https://web.safecity.com/backup_sql/databases/china/index.php?mc_phishing_protection_id=28398-cr2s30bjhva80uk6hku0	Get hash	malicious	Unknown	Browse	211.91.65.194
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	113.7.204.134
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	175.160.12.112
GOOGLE-PRIVATE-CLOUDUS	17247721854992a239a10dc9d698a853fc08f17659bf477258150484d560d105950a258f8e379.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	148.113.165.11
	kWeNis4MIK.exe	Get hash	malicious	Remcos	Browse	148.113.165.11
	Img_anegla_white_JPg.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	148.113.165.11
	http://ebay.to/3u2gAme	Get hash	malicious	Unknown	Browse	67.199.248.12
	https://myworkspace60968.myclickfunnels.com/document--6da09	Get hash	malicious	HTMLPhisher	Browse	148.113.191.208
	https://nakheel-mall.myfreesites.net	Get hash	malicious	Unknown	Browse	148.113.153.94
	jew.x86.elf	Get hash	malicious	Unknown	Browse	148.99.204.55
	http://multichainfix.pages.dev/chunks/patterns/promopath.html/chunks/js/scripts.min.js	Get hash	malicious	Unknown	Browse	148.113.153.93
	https://loginshshhdd.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	148.113.153.94
	Play Now_AUD_autoresponse..html	Get hash	malicious	HTMLPhisher	Browse	148.113.195.178
ATT-INTERNET4US	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	13.32.27.18
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	13.32.27.108
	SecuriteInfo.com.Trojan.GenericKD.73942994.9810.18396.xlsx	Get hash	malicious	FormBook	Browse	13.39.160.129
	http://pub-5378e135058a4d2abb5385b53c4be7aa.r2.dev/response_type.html	Get hash	malicious	Unknown	Browse	13.32.27.44
	https://email-10.moengage.com/v1/emailclick?q=J9hmu1r6QKZrUydA7M0LhmLQ5i7Dg0Nl6MHK33dlRRiHDGLaUmrV29w-y9KVmRzhTLgNQhsm45GxW8V8xKrQoKNDHjB7CRmg_1cweH.uPLe.3eHt_gc8HUYJyNafgEERmJL2LxAT8X7OcG6eGtfAfBO9PAxgYyMwORkMW2Shu_8EgxVomZ4n5YVrJ6BeKFaCmD6d2Q4-0na_EglsL0Brj6yR2v6QG0HeFNJCVHWIDqcMyqe_r88-cETjiVnbQ8n6AdsU8zQ3H7iztnEZXRzETHYdGTm5hvYgsr5Sg7bkrF81eht6fM_e-ibIZP2oMLvBT1zWn_xe_wasEim1gTvVJRTqev1AuuHjN-EARFMZfriSXRqAx2EgGZLcoc2EiPI4kOQISdubWyzK9Xtj10aCP_wAt6KxwJRnrrWNRvn3blBJWnngxtQFXjDGd_qwCgdLvQwPLy5R0skEjnG0HC7MA#V2xjMVEyVlhTWHBSYlhocVRVVktkbGRXWkRSak1XdDVUMVJHYVdKc1NURlVSekExWlZad00xQlVNRDA9	Get hash	malicious	HTMLPhisher	Browse	13.32.27.13
	http://journalscene.secondstreetapp.com/api/organization_user_email_verifications?token=npv0kjeneci&opid=1033948&lrt=rmsqe55tykx&bf=bc07ae1cf7bbffb3bcd5bc7a10f031b8&ip=207.144.57.39&redirect=https://unsus3.ru/oth/chameleon/#mloomans@securustech.net	Get hash	malicious	HTMLPhisher	Browse	13.32.27.129
	Doc-Secure6025.pdf	Get hash	malicious	Unknown	Browse	13.32.23.123
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	13.32.27.84
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	13.32.27.23
	https://cisa2024.entegyapp.co.uk/	Get hash	malicious	Unknown	Browse	13.32.23.123

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6453/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6862/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mQUv:mQUv
MD5:	90E21C35A28EE4CBBCFF16FEB8055422
SHA1:	1621EE323FCD21973BA0B8B99A3C8EA0C24536E7
SHA-256:	5F6136FC6336812943673A6EFC3A4ECC6523C05C8555EA40935238B570BA96D9
SHA-512:	365D120B225F1300942C0F4F1DCFB4A2792860A1C7810C290A747569AAEC72F990B2E207687B1E27175AE8FDD7E965F950D6D3B021194CB328D720651C7063E8
Malicious:	false
Preview:	7051.

/run/systemd/journal/streams/.#9:755236mKsBc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5407861376857905
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4uZOCWtddzBA3VLMl:SbFuFyLVIg1BG+f+M482fzBA3VFji4s
MD5:	6B2377AE7F61247AAAA281A8BB197E6C
SHA1:	A6DFBE1D8F65EDC55C0B711AAC9AB735F5B164D7
SHA-256:	109778E479323437EE381BFB535B8839358D7549733E5D22ADEB2C9B956009E1
SHA-512:	11E915554BB04EAE08C3438630E8342B829ACC78826DB8FCE8677D53C34632285E708763D8C10D053A36513FB8CC40CB2E666876CBF72C0D6F8B16F285205349
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=25eaa885f77d43998840deb9df9602c6.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:755244sjdn9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.519463772205238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmydDBR6MRy2WEsjs77:SbFuFyLVIg1BG+f+MyJn61xFji4s
MD5:	5C96676BB035443AC542310C57020CFD
SHA1:	87A7B9BD841B626970C5C838968D5AD9E977CBE1
SHA-256:	993773754C8736339F55559E66037A5352055E44E7DE8EB49CD0BF52BF989AFB
SHA-512:	18E6065896CEA20921DB144954AAA5EC9BEEB2F77F1C88E73AACC4D29221A420EC20C9B2AC7E2096A077004D04D2D2A7CF05CCF55A037868E7E2642B27B3613D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8644e0ae25d44963b41051213c7ad431.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75869KpdN2b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.408308241836277
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvugVTAbcUF2js1Ha7:SbFuFyLVIg1BG+f+MGgVMsjosQu
MD5:	0F6E54878A5724BB64BB3DBF3E09FDED
SHA1:	84729FE10FD177A67472E4D7965442730A51CA6C
SHA-256:	A5A3A4E9F6551B2C675A78C031E9B5DEF02E4F04520762C1B6D95E57F079BD70
SHA-512:	2E782FFCE57CB43A5BEECEBA7720F41577E489A44BC41F1E74BAB926CEC56D15BD9049941C5D9132F9B84E7B09AFB1F4854734E06C6D364165412112B8E5D058
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e787606e24624bebb95e5ca837a0c5a5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75903xY8ec9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.400148083188542
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9c5XeGEidlbhuqjst:SbFuFyLVIg1BG+f+My5XZhhuqjdCLKzK
MD5:	5E196EAF412E958D56C6D32ACBBE34B2
SHA1:	0C86076F2F95FCF9B15CD50793789A7FB7817CBC
SHA-256:	BFBFD0928811DBD44DBD9939A7BDFA6E42F2A711A5DABCD7C8CA12A041EF470E
SHA-512:	6DFBAB27E95E2E57DD8D952513184209D93B7C0669E0394E79F419AE3156CF880EA0E0DCA22372CC981B48FE807B2F5CDC37B41B944DA314D023921A42E7FCB6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=79c0c945153342baa2605ca74830f5d7.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75914jNVOhc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.378847032771499
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MgcXuUSTjFmzXvn:qgFqo6g7/+0+f+MZXENQXvn
MD5:	98A76AC5EF0F2EE40708D6E9A73A063E
SHA1:	06165910D8BA562B9F67B9373C3ACA6A9FBBC747
SHA-256:	B05CB5F59647550CC03EDD4516CF8BD76F1E32E1D9EA1F13D5A2384C9DA66063
SHA-512:	837E09CF003E8CE2B527AAF1BEE0A6F7948D9A7EAF324B94551D87B9025625BD214068EB5118E809DBB635FB3E202AFF99AA39D5564237954E01E16CCC28B7F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1e989ece4de461abd89d263e641688d.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:759216KWSSb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.418637812871668
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpPycQR63a5lshTu:SbFuFyLVI6g7/+BG+f+Mh1I8jFmzXvn
MD5:	6DFB13C3A7A6B5B067CBFC495104128E
SHA1:	A8776EAB809DE374BC4D393FED01D5E9962E8364
SHA-256:	BB89AD506D45B24FF43E79717E78FD8299099754FA081B6C344664AD5805C1C6
SHA-512:	495F4FC220E6A97F945485CCEE81ECE4E1D1758F3F10A4760E487C2418077F40C30B92072C4DF7B7C1B75DFA305601131EDFEFE8AD87348ECAFF7FB5652C114A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c78e7d99c9d04a67ab63d89a84f6b277.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:75923MBsj48

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.337556402420051
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy/lBWa3UgQCGrXshF:SbFuFyLVIg1BG+f+MyXUgQFsMqjtWL0
MD5:	1E5705E4F35C1FD401D133D9838900E6
SHA1:	EC38BE6393FAE834023F2035D666D3610E816BA4
SHA-256:	4961AE011C7415EDBEE3D6ABD5B3DC13F9C7E9B9F0380B84B1FA33E31489AA02
SHA-512:	8292E04D99750149C74ACC648E71EADF8C97EA552A8AACDBD341D3D0E6ADAB2555BEC943C83054DF35D74D1FDBA80F830018DB1395BB3A8C3A376B91E34F0465
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=800fbdc3363442a28a3c5e99cfa2eda9.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:762030eQb98

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.504427652084475
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MjglhwBSxg2jZcHcljX+:qgFq6g10+f+M0wBsgYmAu
MD5:	166C08CD7682530A5E63195DA16EB68E
SHA1:	39B71897FD045C8BD208BD4826B2A17880A30500
SHA-256:	3ABECD4C1DAFAC6FB115DFEDDD7C6EF6A39DEEA49D3D130CBB0C3DDD112A25D1
SHA-512:	067116C93F7ACD0BA42B170BB346050F042531E0E0EC6007E194E00E4E7100587CD922AA5218A844DC1693049B180C582F0F98F501AB96C9AF1C68429A9ABA0F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8d4463424574e1299c9ad2ffaf81785.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:763286aAPyc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.393535967649917
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6IdgqfcrmUP+sjshP:SbFuFyLVIg1BG+f+M6Id0aUbjbVC
MD5:	73377546E31A81C25F64D39BCB226B66
SHA1:	5CF5FEEEC267FF8BB701E51AE87404E57E917396
SHA-256:	FBF7FC161430608FB1216265FD479F31E2B2FFB010A343ECC0C9918D1601467B
SHA-512:	56E78645D510D2598EF2C397D0BFCD71B00C3F9228E6A2541DBCA789B520FD080E77C50574E08F9C6D1EDBC9E75F7FF15360576DDD47EAF74746DF19CED822FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0140fc184761421c94c49429234ef1ab.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:7636345Anx9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38643650141155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyKA1DAhzLsJsMqjsV:SbFuFyLVIg1BG+f+MybULsJ8jLkGq
MD5:	3FD1A81BAB1AD826820E5A875E33D17A
SHA1:	99A0BE83C69E728ACF91648ACF3A0E6B7C585461
SHA-256:	FEA29D3C0550323973D1D8A2148A7758CE8D07DABCD362F059A09FCFC04852AA
SHA-512:	764E085137346EBCB506E338FDC4EBF7FE18E959977370F638B591CE30A3562EDDC634BF0BBAD61D2F773A1382D30A742409DA2D403713AFAFBF7F122291E46A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e48fe5669fe444a9a939f07c3862994.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76984v1LJI8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.46129824979072
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6QkRG28B2ClsjsjOA:SbFuFyLVIg1BG+f+M63p8QjNE
MD5:	EBB812D2CE94DD06C02B5B91D408128A
SHA1:	E10E8B1E43BCE377CEA62AB17154485B0AECA228
SHA-256:	22522EC8874DFAA36021012C95F3522CD316B74F9C0D5FA65B655223ACC031F1
SHA-512:	18B1AFD97025F3FAADCA1DCE44E83868EF4FF7BB94E45D5DC3890F0E2458E3B1F6F0CDB7A5A72D2444DF3E3FD52F49D6BBFB18A0FEE856361DA1B36A4F6DD689
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0456f68724cf476e9cc9ddb300031f9b.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77502GCr2ub

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.399121496761775
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoM0voZjdCt/rRMtq:qgFq6g10+f+MoE3CDL
MD5:	8E31A193E9356238B0D998D287BC011E
SHA1:	117231DEC3FCE5A43FF0DBEF24FE2C9689DFCCC6
SHA-256:	322CB1679745B7EA469382764DE361A8F95A658DB283F98FB5A1175CDD4B3CCD
SHA-512:	2BE2BB803FBF7D7F07A059AB907E5AA74E55011C74F1C7861E1789A0AC56BC376EC6B5288CE1464359CCE9105E229078032D1B75B84FF646E7EC8D3025381BB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2910795e06e40ea913296ee54244a6e.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77505cqgl1a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.449963938848884
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrXBDFhpqWlsjs2ALAXA:SbFuFyLVIg1BAf+MFsjNALyAZD
MD5:	7842CE8759046097B0117B70DA4DCBBF
SHA1:	6148875E525342C46AE11E5B23A1B3CADD684CDC
SHA-256:	3DA9D6F1A01B493368234692F706735DB3F149AD61E5A5F6BC4DFAF6689F6546
SHA-512:	4834EDB963AA08D2EBAEEE8AF8F766F9BB72B0599CA2570547FE3649CB3646B0D4F95502133708F2FEFFA9F0EBCB473DCEC62927425994E60BF715A6AF4E0572
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa76d1c7d9f9434bbd8861bf0e6c3932.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77676p7hWRa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.468925551284599
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MOKb2jXSxOjNdQIeXD:qgFq6g1af+MOKaGe2D
MD5:	777E1329B96295E5639AFDAB5483B3FA
SHA1:	E6D3787049B1EBF0F8D0D24949BA6EAAEFEFE9F1
SHA-256:	C39ACC9CC04D26C8D5F493BC9E0627865CF690E50DA7BF0CA93A6EE3ED13F096
SHA-512:	DDA2DC765C19C3341B2D2D31099C96BCB297635C88407B7886C0FE446987F32E11371372C3AF4A01689A5BEDC673B40D152A06EF83D4301616DE33AE39B6D967
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5ffca31c7c445bfa1467979e247ed20.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77685nAFVHb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.3847097160342585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpGt1dFA8ejws2lsjs2R:SbFuFyLVIg1BAf+MqFA8N8jNTZD
MD5:	DB6442DDD3D74B3458EC5DA34251F7B9
SHA1:	80ACF72B185F50AE98C7090325E64A55CF499106
SHA-256:	94032A762B738C2C93683FD7D0AE0857E1DB0335EE1CDE962DDA486A3AC779C1
SHA-512:	0292C8DB1DB6FD866850DF3BA6EA8FC53DC009C1E66289345A4636093FFFED6CADD3786463CA5B4A6CF172EA12EB1B9E5B12EFE1AFC92C57C22AF953D3655A6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cbec84ca4d8742d68a01eb91bfa68e1b.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77806aqt2V8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.384928041470928
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9AmCGy1CithTjswxM:SbFuFyLVIg1BG+f+MWN+itZjLTTIWTIL
MD5:	99EF7FAD9E37BE01D5119AF1B122BDB1
SHA1:	044084A0C1E953ACBCDC4C319CB423CA09A7FE4D
SHA-256:	10E4DC3DEB7D4E08CE79D8C1B28FBCC096765911968FB8EAE5B63EA718ED99FC
SHA-512:	B8EE304446CED47D2CB2658986B0DD469D8260CAA03817CCE45F21165D58BA33889CBCF6EF69EC1FCA227D513717E27F4982287486F3CF41B58B170A633AA162
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77733d79a59244c09040647177174304.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78674YXQNl8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.531829832585606
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz2EHcwIaRUEuqjs77:SbFuFyLVIg1BG+f+MfcwIifji4s
MD5:	D9ECCE3389BF1B1B12C74F3DC2B01CE9
SHA1:	8316C7F20A11290AB19C77B8E4C54E2C4F5E18D4
SHA-256:	FA4D912D10002706FCA1FD72BA65EC498F320827ED3F99E21B4C7A180047A52B
SHA-512:	6F23D9702C80435F0707FB20A2798628C8A8024E7FDAFD3AF694F71580D5FBF6A2366FC8BE7FF0B5C160D8A1D41E2C4CB1498AEE3EB62D9B3269F114F788C537
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90c2ab965d1c43668ed9a248a5f6256f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78675ReDkN8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.409698338902919
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzSKAiNh3El3Zjs1Ha:SbFuFyLVIg1BG+f+MGbwq3ZjosQu
MD5:	652139E364E4ED48203CD42AE8A1B286
SHA1:	35FC3996442A480A99B2EACC20D3635F9145A46B
SHA-256:	62EBC73E913126C67C197A3FA7D1430CB3C64312501291BC43B1CC2C8AE87C8B
SHA-512:	A28E7C146298A5ACBD1FF8F3351698434ED9DA7591213D2551CDA010CE52679A7FCAF07FC6BAA00DD2500837D21B27251264E71ECC218053EC9D8A8B8D4DC08B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=96497ec8e4ad4534953b7a5636691a59.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:786833JVSz8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4104447632369865
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4cAaTQeErYzqZjdCLKzK:qgFq6g10+f+M4D4mczoCLAK
MD5:	DECF3365854DFAB2FCB34E7111563CCC
SHA1:	FBC2B85CFA096E2365708333E559D90114AE67CA
SHA-256:	ECE65D12CA9B592C832DDA058B10BAAED795690CE25AF68042D71531FE096AA1
SHA-512:	D68FC381FE3D3A613914D8BE7B95C1AB5C7A1014C6627D5351F3D497E7A13C26889DF2193F79C3B5798001CA8345B6D097C48721BD1A6709EFC4340BC971DF9E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2659b9afc0dd425893f0d7f087a97376.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78691cBJ89b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.461686745456794
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+McAwZE1FU2jZcHcljX+:qgFq6g10+f+McAwZoFUYmAu
MD5:	3FD43E7FDAD41D67F8A29A212A8932AB
SHA1:	92491A0A4C5E50D687D86010A29FEBA37ED37CA9
SHA-256:	A13FA5944B3DC88560D0D3369D6472DEA863901A1CC66359B3DF44EE9F4257FF
SHA-512:	937F869355EFE527198F9E8269B887413866DED9857C9C283EB1AAC1672B55534FB8F7432BFE2348B43BBD60547221A69F88EB20BFB3162DC2393AF6F9621569
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c788ec3691e841189dc8a3b5e1f46e88.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:786924WjXl8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.537140805881724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+6SBRBTDsGWA+Kd0o:SbFuFyLVIg1BG+f+M+6CBTj+Ke22ji4s
MD5:	B8242FB08991232A3A23E470C427EFCF
SHA1:	883A38D140297BA9F426F50599C829064243646D
SHA-256:	BF47AD28235874D0D476487190814CD395F051036BE40FA83AA791EA52B875B0
SHA-512:	C53D44C9F6E0DD0EC1298544E928F40AE00DB1D2CCE8F09B64218CC95050EF45175DB6C1D8AD5AB2C29CECBC7D58199AB4EC30D40770513215FEF41A2D75B61B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44587dc4cd3a455f98c1a1e5b7d12168.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78703WcyFk9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.391098300687258
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9L3bXiJrcR6BzshTjsx:SbFuFyLVIg1BAf+MBMrcEETjNALyAZD
MD5:	10AA3FE6DC04667EA09722C0EAF5F99E
SHA1:	57F8D321C03A76FB2A8D36C14AD400894719ACEA
SHA-256:	1A358066F3FE5CCAF4981C0BDCFC02C860AC2C082294473E7C6EBA0C72DA2478
SHA-512:	3919386E85EF50E317B7CA6C774B3BF0D5D480C352F6041501A96164E56AF60E6BD5A09D7821E0ACB4E7D2E037140F896A4590C507B031454336B2040A4AC054
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d66a1ece7114b24aac77ad039447fdf.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78710yGLSNc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.458390866324769
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mr9rRyGdzMqjNdQIeXD:qgFq6g1af+MrDdzn2D
MD5:	EE78D5641F9C58A3739EF68429A6072A
SHA1:	709BBADCF34432A04EAE0929AB766E1B7B3376E4
SHA-256:	98BBE75A9A5043E11E0543FB8CC5EABC6AC93C0618835E74BE011CCA7F2E51C6
SHA-512:	4D6D99FAD1FB568F0BE746B583B9DF3A7ED86D39613F0B933A528565421C0E510712757BD8083F7AFA1BF6805D9CC8E3CD0B7D23CF2B4A2B36FC1A630EC3A52D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e59e36ae2db0451b9eef4986e2234489.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78875zBz1h9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.39168950902694
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrTAYUGxvBnbAKYs:SbFuFyLVK6g7/+BG+f+MHUitbhYuqjNq
MD5:	40862F778B17D3A2EB4D370378C60BD9
SHA1:	DA822E53B24F63DBE745853306A87F8C1438A616
SHA-256:	BF6C61DC6ADEE93EBEEC32B276C7AC01111FD6492894C4EFD77ED2124EFA252A
SHA-512:	806FC29FF6115695FB040F77D3E71A1A242C59D2404E69DC38BC63D9DFFAD88C9C850EA427329178D4EC25FB345FF65B0958F20F10B321629E148F05C318B206
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a84f9a6151c64420a010d3845fadce6c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78877XNeJha

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.421101496173144
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+My7nQBWDNAZjNq:qgFqdg7/+0+f+MknQvnq
MD5:	F36BE7A7798D9C24C0BD2D6477CE4B7B
SHA1:	480E193D4D2E0440D551AD7457518FD86E7DAE81
SHA-256:	A484D89CDCAD3960E268B1B3C061016946966C3D6FEE0C4A598CB1C8EBD1AF4C
SHA-512:	66ECAF47AF2A918AEEFBE78ADDE4C0C96B84C8C14829C6B73B9622A0DF538E1E16E3AD9F9D45574035349BF7EB2C63DF8DDAC8CFDFBE697765E64688DE02AC9C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=813fbaae1535434aaf668b0c92d52100.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78918g9Bw38

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.55317697275308
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsBQOWd64jGD8jFQMzKaBu:qgFqo6g7/+0+f+MsBQOWd5iD2Tmh
MD5:	81433E4B080E4400332B7E4801E57DE6
SHA1:	0DFD1E235922918D42AAA5D573A519BDCE35CBD5
SHA-256:	6CDB3C59AFF69853BFC0BC123008935D8681959E0E4178FAABBF37B02FAE014D
SHA-512:	1D9F9A32364CF2FF5636EE629ACF823BA21D1797EFC7E85C1FA6CD97B52100E82579A1C9079365C895B9C407660EEEA0CF7A5C3E9861667B729C09C6FDD2D8C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd572a9cd2f44f7b94586a75c5f27b31.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78920Ibnd1b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.508600827996177
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MCtzRjFQMzKaBu:qgFqdg7/+0+f+MoXTmh
MD5:	82C06B7FAEF0502FCF9B85922B23CA01
SHA1:	99E265A58D422DDA009EB3C323381295F3A89EAF
SHA-256:	B44C01B6E4E36D89E248958732C8C1983D6628EA53E9F02ACD4AF3B9CEB2BA10
SHA-512:	283292494FA5F9AED680718FFBF22412FA07862F98F67C26F8DCC8F61AD453B5FE635A734732CFBA38B9F8AF6C876D8807D7EDBB1D4EBBD030E7F07A89EF8E52
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3539188121a94addb57329bd7f978307.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:800328YkRJL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.499444070650483
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+cecj09XPUNgrqjsv:SbFuFyLVIg1BG+f+M+cDj0GNuqji4s
MD5:	C08552736141D409E46DE753A517CC01
SHA1:	6590CA92DA8D6019CA34BD05B4A30D987D126314
SHA-256:	ED721638C958C2A3DE07536C1F5294E98ACD552BB56E5AA8600A5392F4CB1298
SHA-512:	AE6873B55B808421B4958FF31EDBF6B3A86C9D6DDD8FAB54E33F961D7F8937651890E06E960426AFE73F6351850513CDB36B5E3DCA062599FA8C83B6E881EC8F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4fe679fbb4a247a28fa4f7ae47dbfcc9.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80033dBtcoL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.41958002539992
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuaENIKVWvsh+sjswK:SbFuFyLVIg1BG+f+Mu5Vo8jLkGq
MD5:	E7AA44C7F3EE68DF82A371DB223F58F6
SHA1:	596888B10E1C05D0B818FB1301B6F031871D5527
SHA-256:	DD462DB9FB9365EBCEE2F249558D766955F91EA45569B10E312189D15F9AA24E
SHA-512:	F9E35D79A424405673E61518C4997EDC2B25884C1A8BD7ACBEBDD76E651F47B6BA0D8DA2BC0C2AF68C415EABFBFB5CD359ADC50CF1443050E2F07157060D0252
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d109a549a1fb411ca53427b80386c803.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80034r3r0eH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.52679772746712
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm957mlCUB0js7Lbgw3:SbFuFyLVIg1BG+f+MnmCY0ji4s
MD5:	501168178ACF9F7B3FE5FE2076CED9F9
SHA1:	69823167F8B321BD4F0B651014FBCE5F7A043400
SHA-256:	722F3EF5BB9D05FE6854F151540675117A4DB617BB3C7919E05971C7D05F57A3
SHA-512:	B5D9C285B28DE2EA384E4B9A636929309F61E153E2E01C1912E81977B4AF55629C0B4A0E21451D109A3C8BF3F334DCE97002CDE135D1886D6C20D5AF82E9BDA5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72a55de22ec848ef9c0b8fc26781e6fd.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80116TOqyPH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.4306301777047405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8dRGgnDtlWvA+sjs2BP:SbFuFyLVIg1BAf+M8dRvxMvATjNTZD
MD5:	0FDA2D9D6E95811DE5C87CA7BA8F0F4D
SHA1:	C8A1652697D6652575E1208D8674D0B1E3E51C7B
SHA-256:	73451891F39FECED059B713D9C9FE1D8AC12842E5C0B2D701B8D12C7ABADC7C9
SHA-512:	879441C5E71B152F9519E528EAF9708EDBA0C4247FFBD9D97130953F35C0DECFD19B199CCC028EF89191271C8F84A46BF282160C34A21A01089EE6C3F129EFE1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66f912de21274009bd4f85ed828585b3.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80207gDmaUJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.423087809948455
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4Hq6wTVqt4QGrqjLTTIWTIL:qgFq6g10+f+M4/wZw4J+EWEL
MD5:	8B0CB5A8181D0CDD130BA129E061A3E3
SHA1:	FAF66E0824FDBA90733324EABB3A8F9C38005D8B
SHA-256:	5584C78F8F45983B213AEF075B34ACF871EE501A4106F4EAA9821064995F902C
SHA-512:	6571628C4A8F74643EE719B9ADE7E52717D3B2A6492C5C62D876EF44F5B98B3D9DDF494B368729E08D88EBE020F7F17797A4201FFA7E651F63429BF8DF048605
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2bd905addd604c43b8eb72aa456b8a91.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80312OBCzlI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.34374138352099
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzf3SNZUHRn8FvRqje:SbFuFyLVIg1BG+f+MaZql8WjdCLKzK
MD5:	56582046C635C8EE54C3C45B2F23290E
SHA1:	54BFA09B6781C65DBC21EBB24D36A26C48F013E3
SHA-256:	468E87E173B65750A00B8781B3B5413D29DBA439A37EA9B2E54580E4BD33D173
SHA-512:	C9FC2872064E1D176CD91AB26206D7271BB108FAA1FE733417A1667DD36FCE73B94565A2F56E8CDA414B2D4FDF737B1414FA26ABB06D143367CE93BEFACFB1E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a474a173a42439195444e5c60a264af.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80343BNzkgH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.444229696344393
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7RAVdXZBiRvs22jsc:SbFuFyLVIg1BG+f+MiPiRvs22josQu
MD5:	997052052DB3651F6D7E7B3320D1B784
SHA1:	B69C00F92AF5A113D2B0FA9197D0D545F7E1C65E
SHA-256:	37AEEC93A78B84E74FFAB0339DC551C2DF724B8D94D63C18518FD32EEF492A00
SHA-512:	D4146ED4209B52C81E6272CA36E847BBC738E284D8DD928E95B974E4DE3127188224AB647D78B07D514E554A11A869794F7EA226C86E5C16D19C3752A38EE5A6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1685fbf2682d482ba520b878cb276927.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80912qj26UJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.480966631457641
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MhdqUG2QqjZcHcljX+:qgFq6g10+f+Mh0VkmAu
MD5:	0C36CBFCEE76F0E165028B29E2E9A893
SHA1:	BB48EF5048390E801050516787F9624F435DC4D0
SHA-256:	9A857B7C9A2F5D0B56B667BC4A5C13C1A548A1791D375F0578E02F06AAD63EDA
SHA-512:	E6C1D62B28C51364F2A3DD93C38262DEF2683E6B91637F494F49A062F121F0D35E34DFF83AB09DF5198F500D225D339CDD069C24270A28113870E368FB62B481
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5cb3026455444841b11f3ad49b4b4919.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80925lll6oI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.406185608373119
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpKdV7UumDnDE22js2Ax:SbFuFyLVIg1BAf+MkdBUDDEjNALyAZD
MD5:	046CD1A8908F38B0670D218F62D2C695
SHA1:	919905871402157E1E458922B04D20009364B6AD
SHA-256:	C6785212F7D98717094D06EC953837C10480D771CCCDDEDA72203974F43598F6
SHA-512:	66F885F96FAE7A46B79E2AF5AC59AE09B164833FF8C3FEBBD83AB175B6FC3972A93DA2CD02B19E1E4FA26B083AC55039A2A32D63681C1A044366D07324AF7DB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6c64e7c555144e4a94154b4ef71f257.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80933e9oKiJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.42724788531554
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzCUwgDTL7IA92js2BbM:SbFuFyLVIg1BAf+M7hTnIk2jNdQIeXD
MD5:	2A22E567CD0F4315703DE3AD87217062
SHA1:	45EAEE970FE6D6135A71E1FA9C9A9BA3A822A796
SHA-256:	26045BA8AE7EECAC5486B0025399D194D900B9249666F003DDE5E36E1EA2026F
SHA-512:	B2F2FC4075E4F5888F63F2BA0D6E1D30D8A7792BBAF99D42572069448FABEBE750533D0C33A9CFDBA6AC04F6075BB5AFFDF5F1C2870EF9B8A0705DD885F6D375
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a2e20ac47124cd09f617a76a093c046.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81030CHGz86

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.502162020860288
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7PdSRTHn0hg2js7LH:SbFuFyLVIg1BG+f+MkD022ji4s
MD5:	FAD1092356A0BCC452193576CFB4E4BC
SHA1:	46E68B37328AF37B205860BEC637EBCFFC478607
SHA-256:	6C08BC4BFA38C2340FA306DBE982B76255F308C586CD996E4C42DAC58EACD145
SHA-512:	35BE702381B79CBBC1F369E1B7F4DB7A154E1AF5DA92B097B53EE46E0292968026F58B51059771AE5507587DFDCA1D118C07D7374AB50A201C0AEE8539DE5946
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e1fb70c61a74e62a7c5c2ecb23bb3df.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81031JZCFN6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.499068048053593
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8zhH2RWU/VEO2Z2jq:SbFuFyLVIg1BG+f+M8zR2RWjIji4s
MD5:	618B63DAC4C6BF469EF9274B4EADD5D7
SHA1:	C75F3CAC0FEA7618B82F7395DC1C7BF9561FC6C3
SHA-256:	03F7022124EE3880D0A568D5F450FA496D3649D6BC83CA1EBCFBBCA8C97A5D76
SHA-512:	55A14D0DFAD264EB1559BFA4B66B4B2A5D7D191F041A22566201F3204CB3DCBFA67605F1F20FCAD73FA358AF03316A09175B6FFC2F02BF9D3CA802F08C7597C3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66bffeabe39f431ebb6f79690a119456.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81386WEyBD7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4345110221925195
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4DJ02zEYZjNALyAZD:qgFq6g1af+M4G2zEiIZD
MD5:	938BDF701A453372DB88AFB57E5EF7C5
SHA1:	389198B4F4F571C9349D810C07492EA25EFE96DB
SHA-256:	A90566385F6F51456CB1FC13CB8314C39AF4F729E376ACEF2CE62179DAA86745
SHA-512:	BD7EF120D6413B75034A8118982DCCC07F49225D1C56A807199EB51B0545174C5BAB735FA1017826C609428DA055F07957F41E0C9974CFDAB8144ABAB5222B54
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ff377b33b4d4c8bbadc08a59b9f4afb.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81653Ej2U83

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.407985768525462
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuGDrzRgFCKQccD0js2R:SbFuFyLVIg1BAf+MuGDBOCKQcy0jNTZD
MD5:	4E4E7CB2FD2C4F11BE61BBEDD1898A45
SHA1:	43F9F4CA55421A09E1AF79C218DE2CC3176F7005
SHA-256:	38E30F20BC10F00EB313A34AB1F66185F0E3F6C0782CB80FDC454E8C3846CCEA
SHA-512:	93224E786C7D20C28311FD4A0F91404866845298EE15398E53405AF2C29E6371A0627EE2626B17BD7D9353405D433EC189293CBFDF6CA314F273D4D783310263
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1aa4f680b7e4703af0c71b8f69f599f.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:816568eMyN0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.419476435033829
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+cZ4GPFsZjLTTIWTIL:qgFq6g10+f+MjKGPKEWEL
MD5:	03101D9DC168A51276E021C8FA792F9B
SHA1:	D9BA995EB697F85087BE50515CE00D96302469BF
SHA-256:	B26B586DF09019E4A2AD4F1B157E9FCAB822B2E11CB863BDAFE5CE15A4E29917
SHA-512:	742B21E21974014E7E8E8D4DEFB95626DD590E360F761D100101FA14453ED7F6AFA0FA19B283845572420E8CD77BC2D4C2BE94A3BEBBADD4016AFD6F20DC38BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18e942e3f63b4dc2ac8f1a8761ad3031.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81663smsGL2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4322773262345825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7FQhjTP5qjshKJvel:SbFuFyLVIg1BG+f+MAvP0jbVC
MD5:	C1B136DC94A618CD3681B7427D7F6E3E
SHA1:	6DE08B7FE41CFA8183A001A59597859D2CB45FCD
SHA-256:	76CAB8EC2BC2761DBFD496BD1290759F8ADE1BEFF77330F1E35DBA31B6E579EF
SHA-512:	69B7CF26F8A0EAA9D36E4425EF03B945236DA70E5B049F4C42518F72C439EFFD98DFD6C12E152F258E88D3E1D22EA0FC4155F20F1858C4CD58AC7911CD9308D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16be2914ba4c4c598318fb544bb5366f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:816821JgyM1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.434384011382287
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4NAUHXVUR7dQy5p:SbFuFyLVK6g7/+BG+f+M4NAU3a7DqjNq
MD5:	A4386DDE43BAD9147E797F2B291CC3D6
SHA1:	8A2E835B4284F50608B597F41BD96C9F9134B67E
SHA-256:	88AEFB43E63B6F9469FECCDC0D1297B146A3E524E94936BBEAF9DA47F912920E
SHA-512:	A8337A83CB83BD44D4959783E63C6165E01F0A8064F9465EBA8E18366ADD241BE5E55364258D34A389548D067B8D72D499D49FF8DEBDF83C697CC26B1A8CAFF9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=21b7501b2090438d94a2af595eeff683.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:816838I0a73

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.418587521836358
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6RDSBRgRF2Y2nAs:SbFuFyLVI6g7/+BG+f+M6lyR22J8jNq
MD5:	E142935E5E033FC96ADF8A490488497C
SHA1:	1CD275035342E9C4FAB603FFD97200301A545426
SHA-256:	BBAD89B23FAB127F065CADA36C82FAE99C96917419793EDC7AEBB6CFFB5F67D9
SHA-512:	CBFFE238AE6DD22A666D4FDBADEF401BFADB1CBD85571E471CA73D686CA772C9CD3F7165857C5B240F4DD76830E42AEFBDE992520DFFA8080F3B734973BACB4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=033f2ebd499748ddbc43dd25b07b31c2.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81705dRNjX0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4238945032091
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+SwD7FxV3jZcHBrt:qgFq6g10+f+MkPFxVtmBB
MD5:	99CC927C3B849AABC637118EA23FFED0
SHA1:	9BF04029B521EBAA20BF8AB09F2984B12E68CC68
SHA-256:	A488FF4F48C0A5ED5BDF41831FA6D1479A8688952629B6018EA5CCB978A52B40
SHA-512:	1F5D419A2AAEDD03BA3B4384C5F23E2D9808D19EC58983FC56FC2E911266874B70A27CBD34C668FEB1945C2AB5F9B039E2A91B645F458B3FC9A70E0ABF877349
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49e50c3cf2ea46be97ac3b845305c407.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:81706eToRs2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.491887613689857
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M1Q1O3kjFQMzKaBu:qgFqo6g7/+0+f+McO+Tmh
MD5:	796AB1BC79621359B04CAB6561CA4525
SHA1:	1CCF24919093E795F23879AD56778757B96AB47B
SHA-256:	0158B631F3B95797CE9C7C85A54608B36E844945CC25B3BCB6318D27DD0B94FA
SHA-512:	ADB150633E12D0DA3C05668533C120564CDF62FA7700749842286F8512D0D779B2E2AB0DC40A79C6450424F3C511B065A4C97045BE95060222FEA571225C1916
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7f5e0b2335f246d6970b7d3137aea5d2.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81707XjCJO3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.497108222701569
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6KS/GECkjFQMzKaBu:qgFqdg7/+0+f+MEpCuTmh
MD5:	C21BEDB6A5CDDA399BB06A6158482F0A
SHA1:	B6B9BA574F1564E43FFE0E9DCB31028A08729F4B
SHA-256:	9CD5BABEDD37F713969C090663EBEB8BAFD5B0B9464CCD7DFFB7A53229B32F6A
SHA-512:	34EBE4A2B6549DB9793006312E8A08009336104C60F4262EDC190BC85E585155CED89E2093F967576713B078BECDAC07C86284D896528B2FAB5C4AADE18E7CED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0cb9dc5599bc4530882d80be54560f53.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81812FE5FQ2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.385427490490004
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+hXWTW610n1qjs1Ha:SbFuFyLVIg1BG+f+M+hK6n1qjoa
MD5:	692A14F9FD5A636C747A0016B41AA476
SHA1:	976A15D8A3F268CDD5D82A9E768D77772FFD672F
SHA-256:	A955048E33E990F1F135744B42A25B226AA438D5F4DD5323BD2A8CBD1ACE89AD
SHA-512:	A0443EF932A1451C26AF707354FCD5880BA0866529F71A0DC7253D6F729C11BDEFC47DEBC3B2158781C68A9AB2ADE8564EBF13C099979817EEB06F7DA934F5EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4cfd812b38434922822fbe7a80f47f05.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:81859G42ic4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.393291895475109
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4pHLDRWlImTubvA+V:SbFuFyLVIg1BG+f+M4prE7aATjdCLKzK
MD5:	25F838831757FD3B670779585C8259C1
SHA1:	210B08F70F32EE3251DC5BF310DDDA7AD8EF48E4
SHA-256:	A4779E6772765AF47A985D1A6E8AA908D39A1F695E17F1D641CBE22ECB7AFE1D
SHA-512:	82750E9CA75BB685E547A489DB2CB98FE324F51AC60FB2B8B26A3856DDB6401038305E8C06B6BADE338F0E150DC06FB5AC796118E687C26CB691D0E25E182B8F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2556b6d0af5f4332b3f14e80f439e8db.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:82036lQQIX6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403387402542946
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5tWRcEkGcsjswkClK:SbFuFyLVIg1BG+f+MiFk8jLkGq
MD5:	84DD4E557279CF88720536C8177F7BF7
SHA1:	F959B10AE3C349EE0A61E909C9F804E5AAE994DC
SHA-256:	3D2C14FCB087E6D4FACF871AECF66B6248C881426675DFD7993BE4C62A1A270A
SHA-512:	8C54BEBE6A54B4C0A0A81FABF34B8833E024AA5A2B30EA1024C5EA7B9429AA2FBF144AD3900E3E7819D12FFBEF649A5132905207F4659CC41D38D0D24AE8FD37
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3719ed64ae3847faaf549214e6353c7c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:82042RNlrW6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.418036019781743
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp0hRzWBXcE22js2BZZD:SbFuFyLVIg1BAf+MeHzIXLZjNTZD
MD5:	8286E8F87111CD55D4D7D387B9B85C23
SHA1:	CBF6AF05872E57A548E01B308CF0A2AE89CF930A
SHA-256:	FBF4518B8FACECE1815708A63710E1F7D053F9CEEF4728305DE233B6C779D87F
SHA-512:	563E88F37F4B85402FDFE50D8DD830136CCD157B7FFE41B06CC9BAB5DC654508CD65CCB850F2D81EA531BE9B7AE1D3F8987B45358FC9CB4BFAB5290F0664CE44
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce4bd401fb0e45798f738b2cf92a73e7.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82139SIjXr7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.40520465749315
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvNf0CcPEu0wsjswxM:SbFuFyLVIg1BG+f+MtSPEpZjLTTIWTIL
MD5:	25DDF133B3A851A229E867248B1B1707
SHA1:	E4F356F496509919744AD4C6BE4B7BAAC907778B
SHA-256:	9EC47B907E2F68237ECC42BDF132A5DDE3C337B30D492DC471A3690119639E04
SHA-512:	977D887154009F80DB6CABD5471E134A4AD216B770B1B6A9013109F455F66B9791981E5D4C1C6E7F628C4487EF42C12F960BBEE479A6A9E65DEDACE4F8964523
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed809ca3d8ff4df4973529e8ee7f6a0a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:82242mlW3E5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.405062958050621
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyEjR1R63y2jdCLKzK:qgFq6g10+f+M9R1RMCLAK
MD5:	6105431E1A39EFE125ABFAD9097BAC4F
SHA1:	F21D72E49BB5E3ACF38866D1140F5CDAA6F1FA21
SHA-256:	ECCBB9ADC9BED180D5C3E8448CB441B1467F44B7BE9014242F634F30BA08BBE8
SHA-512:	FF79DED2ADBB371ADA79F9D28524EECB90AAE2CACB7F1F790166123594758E62863AF17397A5071B690B4FB5DB3DF7DB9ABF5CBDCE0215DDD426AEA3052A35F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8218fd035e16471db49a43f6669a01f2.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:82249oLNai6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.385762172316095
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/xRNvnO+W8jshKJv4:SbFuFyLVIg1BG+f+MPEz8jbVC
MD5:	E399C135033B9D2D66D91542D7A64EA0
SHA1:	63AC58878D7DDCAD62D294080A1713AB07D50F24
SHA-256:	6509E3F0CDCEB5463C03A17EC4A77179D2D603BD4502666EFD578FC7D04756E8
SHA-512:	6F2122A0C1AE017B80D349CF12A5207015A8518094CF0F8AD31163B43CAC1C5AFE787F4AB407680CA7485BA134A5FE4164032469984370B51FA40CEE7A697814
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=53e5965edcd946d1beb3a266f56a2c9e.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82370MnveF7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.437091604251899
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrQWOS6WWYgrxsjs16:SbFuFyLVIg1BG+f+M196WuqjosQu
MD5:	BDE2B3634353B20BC865E0569759DB28
SHA1:	1F840E11C4544C9B0D779979B82BC7F360FE413A
SHA-256:	8B8ACA69D6BEA0345F55E53242A9437C6A136003959785406162CDDA96914DB6
SHA-512:	BBE934397BB6346A1277A346675CD2C27AAFBC1CF9106A9938AEAC54B8B29B1F714B6CC2A957FB9161AFC7E017366E587E145F7E1390361FDDBD85B39C704C26
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a55fee6bfa1249c9be8b4187e175cb33.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:82443tZvWs6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.491143135810039
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7YNml8YUfhtYTjsig:SbFuFyLVIg1BG+f+Mic0HYTjZcHcljX+
MD5:	51F1785BA19EF577CB13F940A08BD7AB
SHA1:	8464B5A0249A49BA625067361305236AAA8EDC48
SHA-256:	0B0CC9B042158957CD60AA973A758A6F1F041C8340B2DE7526679E26F2C630FE
SHA-512:	625C87B2B94020DD965A2FAE3B7161F7C6E82EEC2B19AFB0CC90BCB43A560144E421142772A633F8A14ACACB8CC0D2FA24AA1400DC143F7F18D7B98F324F8B35
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1fd3ebc28c974d6b91d1885abe20abf8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:82879AjOg72

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.504172698060766
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ZJgTXBYYHvshgls+:SbFuFyLVIg1BG+f+M7JIY122ji4s
MD5:	6FAA1D7631677BB481FE8BD96A28088A
SHA1:	8D076513C3300598494560551335D844E12EE409
SHA-256:	C0F0D25975F6C9290BE1CF4EE8AA7B4E2C502928DCA675A21F6872DE99705AE2
SHA-512:	923F8A878724624341731726C956F0D141D6D55365C29F19DE0CD1A956BC4F982D7FC2D509BA3CF6128580659C98FD2EBF4518F0934AF742C1F63D06ACE2BAD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ab903a0e64b482eb74d475e5b07be8b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:82880Hs8lm2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.438530067342097
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp0xU/dwn22js2BbQIeT:SbFuFyLVIg1BAf+MmxGKn22jNdQIeXD
MD5:	E9B78320378ED8067F0A9E2CE2CD2114
SHA1:	9146B371C5A6BC209C84AB1855BBEBBAD96A0123
SHA-256:	B74ECFAF973E16C768736D0F0772DAB14D8D2761A6FF815EFAB23C1C5F863462
SHA-512:	7F426FBD779E6BFBF299F3EACB5EB2538400D0203B83FD7292E106B1110E144DB815B2DFA466F546D82A0EA8C0BBD98C8768B4BFE7ABC4832F5ADD6B0FF24E95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1a89b40a46c478a81bf99f1170b0007.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82881bduZ14

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.519923904190747
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpJGTUicNQR+XHjs77:SbFuFyLVIg1BG+f+M/5Nu+3ji4s
MD5:	65B43A9B0F25EE155C253AEEDBED904C
SHA1:	E6D38DD819A55608ED5E1E9565DEA1C60678410F
SHA-256:	C9CE36FF8FF12B2D6181B9B25F8302655B4AE1BE249CACA7D4ADC8F4EB91961B
SHA-512:	5504407529583DE0961C504A822293ADECB1AF0D15F6DF7E991561CD654D0C8B6C3EBAA8EC0117B9FE4B085FAA84FAEF74740667B59F58B2DE514DC3F27F11FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5f0cfc2f16a4f6b9d90a55ce218a227.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:82887pwbg54

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392610600042051
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpZKGuC3ecgs22jswK:SbFuFyLVIg1BG+f+MX3fjLkGq
MD5:	A0BA863D7DF479B768F414FC76DF69C3
SHA1:	E9173E1F7891D47405475C43EDC67A922C3CA4B4
SHA-256:	D0D52ABC4283ED0E1CAF44C55E99E29B174AC9AFC091DF0490F08B50199B70E0
SHA-512:	9B410D80CBDE426B9F19D5A5B9F0424820814F14A70E1FC1FE88133DD2876A1FCEC89EB8F6C5A63D89AC47CCE0C0F4D62509939BF4A4D6280ADC186FFFD572D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb4004bb737c4f7d8e7a679cd94af49e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:83525csLSL1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3734192326018215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5nyxH3LN1pshTjs16:SbFuFyLVIg1BG+f+MlyBBATjosQu
MD5:	924135B27FA5F7E81E2369DD25644D7E
SHA1:	2AF8BF32637C9801E32750690AAA393E1CD5AF3B
SHA-256:	E2B7D74C62FC75CB68775A67FB8EC7BCE7CE80D702FA5B39C1708341CB13071E
SHA-512:	7FBDD9F85793CE4930E5B181D2F7BA970EC9B1C9650BC0B959AF7F58098CDEC3890AAAFE95BBAA11C6880E235B44C68481AFE47124B186B7D661B6719366541C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3940eb0cdca444fa80cb24d6b6da91d9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:83526qGHdZ2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.375055386318958
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7JSdOUWN90wsjsmNm:SbFuFyLVIg1BG+f+MVd0ZjdCLKzK
MD5:	96F5B4BA94841A81BCEDA7CEF02EE540
SHA1:	89AF3B5BD4267ED61C825BEF2DB4CFB5A0A6F64A
SHA-256:	886B8BC48715EB258193D8DB2EC9F0865F1EE7C653E3292FFB6DA33FF0CA6A8A
SHA-512:	9AF1A32D660D76C0E482EE85233CB317DBDB2B74028A51054349085D564D3A993B022B8105F012AE3DE45903A2417AA1E5530840773CAFBB05E1435D01309A55
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1ff81378346b4101ac9400e686b6856a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:835290S6Px1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4621406794118395
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm55tyEGUIfFrxsjsig:SbFuFyLVIg1BG+f+MWUIfRqjZcHcljX+
MD5:	7E104A9085AE1DFCD874A3A1314F28DB
SHA1:	0FCAAD7C88B4D3B28E087B6289689DC9DA6BEA90
SHA-256:	FFEE79D0622F7CE6792E05E78CE58CC72A02757BD769A203AF15EA4B69D3DC0B
SHA-512:	709F8BF033953AD88EB6602D7126974EC9107214F9BA2FCA9813334E57EDD87929245762C5F1CC8BE23571C327A912A10714A8AA4C7DE57ABE7C23A1E9A46397
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=394285440d714a488bc8b8a1bec1a37a.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:83561lZvAZ1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.330240179846826
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmofmDSeAeVoswsjsiI:SbFuFyLVIg1BG+f+MofKAn8jZcHjv
MD5:	A133A4AF5EEE4F84E9E70E20A3B4CAB1
SHA1:	8B585680D7A79706D99DD03B6F587F1FF87E24B0
SHA-256:	8B4A0C119E8520219058F85939C88E256ECAFE8C2ED701FF3858B6855BFEF3AC
SHA-512:	125FC0F0B5A5E08BDE46E0C313E3F46A3E39AFD7246457C3326A0EAE42CD969123FB84B17DEFA82C1BF9243164E014C495A7323AE9CEDCDE04A01854C0F6C3D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5c6d5f709304a4abb63e1ba0aeb1b23.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:83599mm3C13

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.358695596308546
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5TTfyxI40lNrqjshQ:SbFuFyLVIg1BG+f+MNi0lN2jtWL0
MD5:	21B0F341E482B556ABCA73AF5BA2156B
SHA1:	84579DA9217E7ADE20BEACB9BFA251D2992ED1E2
SHA-256:	AAACAFA76330B6BE1D280093649C628FBBBCE89CF6EBB42C9F2E0E5274F362AC
SHA-512:	EC4BF780D2B4103492D35672CE67D856868811858699BE9D38B0A91AAC10EDE5B4E23288720B071326E528CE4E9D26CF320CD91D55CAB44943AF93A500A3E3BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=34002861c41343a887f1253cf4322fbd.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:83678n4u1l3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.359050744314425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrBkTGlyeaGcks22j+:SbFuFyLVIg1BG+f+MiKyGck2jLkGq
MD5:	D99BDEF296A4FFCD79E17118E2759D97
SHA1:	B49B402CE4AA6D27881E7DA677AF431CC771CCA2
SHA-256:	1F5BB1281B9BFB7FBEE1CC1E487045A7C72BC4C3CE00BB519DE023E45FA32C0E
SHA-512:	4B44A6104DC64C0D2275B9C38CFF5C295FE0552B480CD716479C97475D23ED6E0FFA0835F6178CEAFA0D7C9D79D28D659FA7DA9CD0B035A1F8A98A5E76DC83A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3c906c5afd149e18a039e5cdd3c9906.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:83789wvvF41

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.406974443270227
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzxWPqx2jshKJveqDO:SbFuFyLVIg1BG+f+M72jbVC
MD5:	6C889D78D8F312A65F955EDBADC3BFEA
SHA1:	3A573116292F543F0C62BCA3016A2857D5804745
SHA-256:	3305B463D3844467499EBBC27B7B48CECA2409CB3CE817550B8A9AA98FCDA6C6
SHA-512:	8E5FA0EC4C77FA0E56F46591E476E6063998BFEB6B0AE30F9C16EE2881FF86F24A41E8EBAF4AF2CD6A0C2751C457F0CEE4A41E23170EAF5DD7AEEDC3FE2CD88E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=957462499f904b8594540c5eb0c9158e.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:844151rQ1C4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.435790032178095
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmosaBVcsGHxuqjsjOA:SbFuFyLVIg1BG+f+MosIVxQxTjNE
MD5:	A9CD9AAE05244466C63C2B19AC574015
SHA1:	0AB1387750EE152D79CBBA59E1F72E9B491FAA6B
SHA-256:	ED88EC59798D969EB1F33F9F16E40A0096030A945244621B8F5BD6216C109DA9
SHA-512:	7DA8F650C95B00C41009B6375F8630DA4A8DDFC6AC021646092EA1DCEE4EDAD3E5AEF8AE066D68954D6AE7E1E0FEA14C9A0F3F8CB0DCEF4C6BCEFCBA2EFFCDC4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b9110bf3dd3a48f0922b18f2d6162b94.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:84783zMQqMC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.523484386340842
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo8VMcaWDDZQpXsjsv:SbFuFyLVIg1BG+f+MoEdaIDuaji4s
MD5:	83407B0B6FA365B864E83B58974955B6
SHA1:	858D8457B6C52A86B6685C586AFA35CEF30B8123
SHA-256:	9CF0DEE6129BC5335B88C0D9B3AF9EFF780868D54345C9D6BCC35648773BA12D
SHA-512:	47568142E79A46E030506593BF41F1527E76E28873E87A1351F8DA2D79EFBD925ED0F4B805580B6A2E02D822C82C5DE922E59D5AE7468199B18E6E39796199F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b13a0d1457cc4976b2f3231f012a2edb.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:84784oPrrdE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.461712212226831
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/oc9WWBX2NQZZGA+sj+:SbFuFyLVIg1BAf+M6pe31jNALyAZD
MD5:	D7B23D9F63AF25DE03C597442EBDF866
SHA1:	7D23F3A56F8A6A53A1E68EF3E8D2D66297C64E4F
SHA-256:	3B9E949168B1464BB17E2E1EAA76B7A4A69AC672A9A589C30D2AF15E9A49CF13
SHA-512:	40B334E6BEB0D6A0FE15377FDDA070819F452D32B09258A601E48156F4C91C3A374F0522E894C023191F1788AFF1928827985C565725F929DB7A9DF551B8B243
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5f7b9b8cd3d245ce8cb8af719e81462c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84785XWlh4B

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.417845100628353
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsGAJKDlqwW1DPsjs2BI:SbFuFyLVIg1BAf+MsUDltWRUjNdQIeXD
MD5:	A7BF8CF1DA349E6DFD6B0D2A59177B1A
SHA1:	84A1510C92AD04BBD8B77403C877F1F0A5B03A2E
SHA-256:	784E4A89FAAC6B70B898935AF0EC8843607777C6FC3127D065D156E02A977ACA
SHA-512:	DD3C7D8B6AAE77DA0286BED533A3B7B4B57EE9E62425E3AC1097067BE8093589BF79E11CD7C917A695D3D84163ADE46540D8E10AF725F15EBD03F7D5B8F03339
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fcead146ef7d43808c1a8dc90aa468db.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84786uekhYE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.51369266692361
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6kHd3cbCCdEsjs7LH:SbFuFyLVIg1BG+f+M6kHd3cGQji4s
MD5:	2C0E20ED9B7E40ABDFDF0411C7120446
SHA1:	957F0244309570106284EE6CACBD3A4C73E0C9C3
SHA-256:	43153F6094922FD30ADE0DDD08225B37414E843ED39D8877D36705545DC383E9
SHA-512:	490FB0DC0C64DA05942769C74655DBD4B86ECC7B34CF23D09D921252BDFE55FCFA728C022385634B0EE4EDADFF0264EB39492166B526EBC5ECB871E106D32445
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0bc04532ecf24c589c9ef48f3a068e81.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85192EXhuiC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425186321900641
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M87FABmgAcmqjosQu:qgFq6g10+f+M87Fk4V4Qu
MD5:	2198A8103BF15BDB18608DEDA1A7CEC6
SHA1:	F8ED2DE18A228D348503B203D1EF7C63D1B0DA3F
SHA-256:	639A8AA03290B62BA3270B95F953C57AEEFFD4FB85EC754105D1EC3112953BD3
SHA-512:	AA0345F91065ED0D37AD64CF85866A23BD232EAA329C3CF45DD02ECD8EB12129586DBD36348AED42385C2F7A95C328C43AD6173AA9BB5EC3A476DB6D6BB60E06
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6608b676af6a4c439298deadd22a4275.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85199dmVksF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.387785900149501
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GwteU2ClsjsmNz0/:SbFuFyLVIg1BG+f+M4GwteUsjdCLKzK
MD5:	CF7527ADDA3C2880CA290D7AF15E2409
SHA1:	C31CFC9BDD07A83245EFC22A9932981B2B53096B
SHA-256:	2263988A5A8E052831EBCC74DD3FBCB05A8D1F4EBAFA59B197994642CD4240E5
SHA-512:	8687A08B4D0EBB375275D3FB95EE322F66BEABFE326C18BEB48A65D217044F261F2495901647E626F2D7FA5E70BF9EBEDEE450976E53E3C0AF0D78F3FCF69895
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=23d4f09506444c51ae9eb72219b1fd11.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85266T3PJQD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.473237524231867
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6tMKfYTjZcHcljX+:qgFq6g10+f+M6OoimAu
MD5:	BCA8152C3C0D1FF101451D2D5EC46A30
SHA1:	C58D260A29410E440A3E8AB44E32B4BD0F3D8A69
SHA-256:	44DEB35EB442DCA58D7B3F85485BE31976E836C14F86F57D32C225138BEC2FB7
SHA-512:	8077EC509A3C763D3E74A91312785B0CD9F88870FB53B04BE542470330267E0A79992461F657587ABD09D092A3EB6CC1A5C6333883343548814884B43E3798B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c994aea334c2454195e7d163e091086b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85290HzuvxE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.365321321311026
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm68SHRMQqoEY+sjs2BZd:SbFuFyLVIg1BAf+M68Sx4oEYTjNTZD
MD5:	C22EC43985F4F967970A761DCDD3BB74
SHA1:	15C3643E5B4F079BB3FB520163875BCE6F728021
SHA-256:	C8D99F5335DC0C17ED1CD8910FFB5A27074A709E013A9BA08953D1174AD24B4B
SHA-512:	C584E18A6A9ABA90200EB9291EDA7B0DB232BD0CDFE4DEC4294FBFFFBE7FE917A17D8A5C1B29DCF6D7F1ED6429DC857A124DD948A3B1074968964C492620D519
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a0e89c2b4874a4ab294260d99ea5a0a.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85312uBjfQD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.417223174459186
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpxsDBFw3UAgB30jsV:SbFuFyLVIg1BG+f+MYDBFTEjLkGq
MD5:	4541E1250B9C04A9AF9086E53DD5157F
SHA1:	B479AB57CD1F499C61D514834BE4BA0B2EF12556
SHA-256:	DD149C28837672984E0841DCE392E0201EE9FFD1F13146F8624BE85AC8F0736B
SHA-512:	CE8ED9725EB6AD21178BD4E6D4017CCC536409131E1938E5A69774010575D149449464A69F84C684DF3F269A61725A7C95A3804CC2B76C2F8A420D84B10B64EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c95b27a95fa24e69970bb54413b76de7.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:85397GsCXrF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4324737917499535
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6Ia7Jg2jLTTIWTIL:qgFq6g10+f+M89g6EWEL
MD5:	B1C16F0C5ABF48D536690E3AC406A53F
SHA1:	131FE79BF581642501FDAF924DD3F49E227EB746
SHA-256:	B0E5738432D6CA24415C4DC5DE758FB14FD3B7260F25FA17D91246B9BB11DAF6
SHA-512:	A420F3D46EAC3A6877DEEB2E2A26F5A3D9FBA0066035E844582590FD25E30D331B999FFEFC6DC115ADE397799DA2CED11B7FDA3A844D5CF9497C89DD0C61E1D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=014f5ff311b443ff9508cf4636135d66.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:85506s8A1PB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.373206499361921
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr6SOOsTSHEV0jshKe:SbFuFyLVIg1BG+f+MmS2eHEmjbVC
MD5:	535A555C147403F065EF43F585E82313
SHA1:	3F6121306EEF0146C7C4D5A6D73394FE5A22DC0E
SHA-256:	842DB543D4BD02928DF57B8775B2F0250BE3E42D666CFB58E59EA1FE11BCE202
SHA-512:	DE8DBE96E49AFBFBEED2C25E923CB7DA4E2F9D4561A9B91D9993C35673A849A31F623F7D65C1A5CB5A3D1DBE6CAB87628C274E5A44D126FEC905274AB57124BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a39e30eece1a4065b0a75567b544c8cd.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:8555763ELBF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.440887601557367
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/xDNE3BNcuclmFF:SbFuFyLVK6g7/+BG+f+Mo3Tc8rqjNq
MD5:	C90FECAEC52F476A4C8189534BF8B982
SHA1:	E5FCE77D1085AFD06323635309065509E3C5BE1D
SHA-256:	0A29914252B71FE525C26B0C23101C725B1F50991E76A599A0F3DA7E63F87D9A
SHA-512:	086FD18583BF8C04F1CBB6CD546C42025CB5B9EF20F2C8D20D6F032CEB93AA0F8F1D0BA48EF131590FAAB2D1E587F165D79BA02072C7AE10DA12A144916E093E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59ef11ae8cf24e94853937a9294cf8ba.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:855590z5ELD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.43208462155815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9bDcngS0js2BDf8:SbFuFyLVI6g7/+BG+f+MFox0jNq
MD5:	67FCC8FD058D084104ECFDDEECC0D01C
SHA1:	DE87F817218B2FF4875A4530A862E093BF23929E
SHA-256:	21F840B95B6D9CA3A6572C2EE2BA0259A0AD0C3B4F57C89DEE86576F93B8C76A
SHA-512:	D6C6C19FED6B2C3D86EE12FDB26A96DF476B782C642C88188492641F090D921F9AF5E8556792FE2C1020E9BD0A3C46FD43B0F7A1EFFFD39E9FF4B1FAAF255CEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72bc9f92bf24454da35b0119a7026d54.IDENTIFIER=gdm-session-worker.

/run/systemd/seats/.#seat00E54R4

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0GZOSoB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0HHPrQA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0K0pVeC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0O7cdpD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Sy6mBn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0b4vm7W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wxI9CR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1274tPoKB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Bd7Q1B

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.44683451471068
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgbLqjWit6B4J:qgFq30dABibB3TgXqaiIi
MD5:	3CCA6AF5C2EA472FEE6D1209BFD49835
SHA1:	573632EECB9FEAADE6545A2399819F894013E004
SHA-256:	B9F8ED7EB96800C9146E3AFD9ECF4EA5DA927100BB98602B8654D9701947E7C1
SHA-512:	D4E2D5344BFC2CECF6AD74DF15122790ECDEB4BE1510C4431784FEA741B24DAF3E38B374E6D9F2394A2A57DE506492A94DB0CC8025D04122A3568FB74B86141F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1724913824291443.MONOTONIC=465551156.LAST_SESSION_TIMESTAMP=465648533.

/run/systemd/users/.#127IvAfqB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffcgb/fRvpQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB0gTRvpjthQHtPYq9M
MD5:	4DE52B9F71C92525ACF799568F302477
SHA1:	8A0F0026B615D85AAC921ED21C3C5552ABE10EDB
SHA-256:	79AD93D91B178665AB374FE490D5CCD73E00AC70D0E4FCD4223924D0A8D6F739
SHA-512:	4527404499EB4B50AEA7B5ACC6802832C1ED5F3FB616726D797CE8D1D232809849A1DCEEE1934A6539F068766729577460BA825527EBAF57978274DA05162E04
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13849.REALTIME=1724913933565347.MONOTONIC=574825059.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ML1rhB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29936848691354
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gbLqjiRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gXqdthQHtPYq9M
MD5:	3A1DD6F42E389BC413D458F3B533EA31
SHA1:	6D80D2E4B678FADD53CE229918D90D8097414145
SHA-256:	C1CCC04D9D3997CE599EAAEA01D0EC55340EF7513FF0E06C6201E6B141851255
SHA-512:	86BA2B1B394F6AF1A8A82E607AF4E213306D683527D3847E13FF114BA8F19C4DF195438D1CE7DDEB15317D25D97A0E47FC73657B94F632100CC6092CEE2FB175
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1724913824291443.MONOTONIC=465551156.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127X7v0cE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127aBRryB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29936848691354
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gbLqjiRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gXqdthQHtPYq9M
MD5:	3A1DD6F42E389BC413D458F3B533EA31
SHA1:	6D80D2E4B678FADD53CE229918D90D8097414145
SHA-256:	C1CCC04D9D3997CE599EAAEA01D0EC55340EF7513FF0E06C6201E6B141851255
SHA-512:	86BA2B1B394F6AF1A8A82E607AF4E213306D683527D3847E13FF114BA8F19C4DF195438D1CE7DDEB15317D25D97A0E47FC73657B94F632100CC6092CEE2FB175
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1724913824291443.MONOTONIC=465551156.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xXPIjB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffcgb/fRvpQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB0gTRvpjthQHtPYq9M
MD5:	4DE52B9F71C92525ACF799568F302477
SHA1:	8A0F0026B615D85AAC921ED21C3C5552ABE10EDB
SHA-256:	79AD93D91B178665AB374FE490D5CCD73E00AC70D0E4FCD4223924D0A8D6F739
SHA-512:	4527404499EB4B50AEA7B5ACC6802832C1ED5F3FB616726D797CE8D1D232809849A1DCEEE1934A6539F068766729577460BA825527EBAF57978274DA05162E04
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13849.REALTIME=1724913933565347.MONOTONIC=574825059.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127zEMjKC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.2999891873746545
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgbDXlmf9hWi206qodv4J:SbFuFyL3BVgdL87iesnAiRJgbLqjWitn
MD5:	B909036616D1620CD3FFAC61694C19E7
SHA1:	0864B6E8A0BB63F7906B8D61551833AD51049A4D
SHA-256:	292544739AF10886D74E9739FA5E9B3DA66398C0198913E91DAC905FDAFAE130
SHA-512:	1BE9F214B132B2C36276BA1ADE90CC8D62B43EFDC52E28D64D364569A5E26F12EF84CC19BCEFE891D00C1095ECF4210DE25C7845A10E5AC76DD3E89640F857BE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1724913824291443.MONOTONIC=465551156.LAST_SESSION_TIMESTAMP=465648533.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:etn:etn
MD5:	0A272FEF246E9A1CCBCD41430D1C8FA5
SHA1:	7488EC35223436040BC15922992900456AEDABEF
SHA-256:	746EA631F647B0FB0989D1FC30F8B634D2671C46DE491B325D860E83A8EE478C
SHA-512:	2F6D8B7FE909F6C89DF425C7B69ABEFFBC033B57D62D5C5DAD1CA0B4D1689DA888718E5C519A408C50AAE90B9761BBADE65AD82BEA5BCDA7646C3E4B6BF26E2C
Malicious:	false
Preview:	6308.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E2:E2
MD5:	5CC231AB175D871B0714FCD9655C8371
SHA1:	EE47D5438E042138EEBBE85BE0600F6E06B9A939
SHA-256:	EB14D37B96EC42A598AFBD9F16E29412C4C567CC9D38E9D98D73CB6D61110A10
SHA-512:	ACDA611E67910A81A61383C021A4C3B26BD229EBD5E9A4BA538FEF7B9ADB7AC3C4C80CC8FF80334963425773CC42B7E7F38ADED0BD442079DF85E6A0B43313E8
Malicious:	false
Preview:	6941.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:nCsXlXEWtl/xlLDz4:nf+ylJl3z4
MD5:	905321CB890796C5ECF503C8E4D0EA2D
SHA1:	3DE3B7774F3E8B0BE2711990B9EDA531C0CBFC1D
SHA-256:	D7D6BD0E9AD12985367F4AEFBC13C6B56F3632F73A184F2DCC1F18DECD7EE040
SHA-512:	A1FAA91BE847C4B7B4DEC0F4EEB079385CA5544E57F7C37E7D721128AE576A532454ABC795F4890A2CAFAC96D34B4D3C668129CCD39D39DE0AD6277BEFFE593F
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................%..f........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:De:K
MD5:	0A513809A697F1F15F849326D28AE989
SHA1:	E87ECE20D5BE129444257D8E77A79912BC5EEA18
SHA-256:	C3CF87566B81C7F0CBF7AB62BE382859610E4EE5A69492F4FEC25534498E0140
SHA-512:	1E4E399FEA31D6F74FB122B5A2C45B8207647B9DDB8FC633E2CC91C1755CDB14950285E85C60024C9DEA07B3D8B767EC062198775846170E7C481CAC0A680ABD
Malicious:	false
Preview:	6939.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:aRz:u
MD5:	01E331DE98A776C98C77090F8B15BA8F
SHA1:	57F9A4A97307F13AAF0B2FA4FF0818898F2FDF69
SHA-256:	7C27026B0E0FBBBC4988C94FF88EF40B7E51DE752C3A62C6531D3E81B73FDF75
SHA-512:	FE905FFA9CAD3655C0033CC8B0FC9441B599004C864F0E03A34FEE3E9B77556633A41B0C98AB88B6C99D1CEE635643B9F335FA5AFE4A5E733019120F762C9D22
Malicious:	false
Preview:	6852.6853.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E2:E2
MD5:	5CC231AB175D871B0714FCD9655C8371
SHA1:	EE47D5438E042138EEBBE85BE0600F6E06B9A939
SHA-256:	EB14D37B96EC42A598AFBD9F16E29412C4C567CC9D38E9D98D73CB6D61110A10
SHA-512:	ACDA611E67910A81A61383C021A4C3B26BD229EBD5E9A4BA538FEF7B9ADB7AC3C4C80CC8FF80334963425773CC42B7E7F38ADED0BD442079DF85E6A0B43313E8
Malicious:	false
Preview:	6941.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:De:K
MD5:	0A513809A697F1F15F849326D28AE989
SHA1:	E87ECE20D5BE129444257D8E77A79912BC5EEA18
SHA-256:	C3CF87566B81C7F0CBF7AB62BE382859610E4EE5A69492F4FEC25534498E0140
SHA-512:	1E4E399FEA31D6F74FB122B5A2C45B8207647B9DDB8FC633E2CC91C1755CDB14950285E85C60024C9DEA07B3D8B767EC062198775846170E7C481CAC0A680ABD
Malicious:	false
Preview:	6939.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:aRz:u
MD5:	01E331DE98A776C98C77090F8B15BA8F
SHA1:	57F9A4A97307F13AAF0B2FA4FF0818898F2FDF69
SHA-256:	7C27026B0E0FBBBC4988C94FF88EF40B7E51DE752C3A62C6531D3E81B73FDF75
SHA-512:	FE905FFA9CAD3655C0033CC8B0FC9441B599004C864F0E03A34FEE3E9B77556633A41B0C98AB88B6C99D1CEE635643B9F335FA5AFE4A5E733019120F762C9D22
Malicious:	false
Preview:	6852.6853.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E2:E2
MD5:	5CC231AB175D871B0714FCD9655C8371
SHA1:	EE47D5438E042138EEBBE85BE0600F6E06B9A939
SHA-256:	EB14D37B96EC42A598AFBD9F16E29412C4C567CC9D38E9D98D73CB6D61110A10
SHA-512:	ACDA611E67910A81A61383C021A4C3B26BD229EBD5E9A4BA538FEF7B9ADB7AC3C4C80CC8FF80334963425773CC42B7E7F38ADED0BD442079DF85E6A0B43313E8
Malicious:	false
Preview:	6941.

/var/lib/AccountsService/users/gdm.AEPTT2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.B11DT2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.909618283975335
Encrypted:	false
SSDEEP:	24:KmZZ4smZZehmHNm7rm7emM5msAv2msA2+VWLmN:KGlao3ZSv2SfVWLQ
MD5:	7AE013864F5ED47A6C0FBA7B1D6846D8
SHA1:	EA7F65E9F44A88B3855D1233C93C9DC0E73AA430
SHA-256:	307686FEECE07E6CA958EE2CEF25F0CB2DAE90DEACC73BAD2BD81161B1AC6ACE
SHA-512:	2B12E7D5E3556820137B1B736717B29018AA3B4319C07915695E402E6091B3225F078CC1033C13262E4DD91DD7EDBED1C9C2DAA929C379D57E362EFFB0CEA833
Malicious:	false
Preview:	Aug 29 01:45:56 galassia systemd-logind[6993]: Failed to add user by file name 127, ignoring: Invalid argument.Aug 29 01:45:56 galassia systemd-logind[6993]: Failed to add user by file name 1000, ignoring: Invalid argument.Aug 29 01:45:56 galassia systemd-logind[6993]: User enumeration failed: Invalid argument.Aug 29 01:45:56 galassia systemd-logind[6993]: User of session c2 not known..Aug 29 01:45:56 galassia systemd-logind[6993]: User of session 2 not known..Aug 29 01:45:56 galassia systemd-logind[6993]: Session enumeration failed: No such file or directory.Aug 29 01:45:56 galassia systemd-logind[6993]: Watching system buttons on /dev/input/event0 (Power Button).Aug 29 01:45:56 galassia systemd-logind[6993]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Aug 29 01:45:56 galassia systemd-logind[6993]: New seat seat0..

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlICvXlXQCvnl:F34CflgCvl
MD5:	FD36285C3E8F17456D256C4D88F4172F
SHA1:	221A935A65CCBDE6CE24F458FEA9F744F5E559D7
SHA-256:	5015A78E46C859ACDDEB6334732C6348B8B8B4E737343473F357F45D49F391C1
SHA-512:	AA5D561C981146007A57067C0E8483D8779D5014DF901F50159792936C44266002FB37888209CE7F6B5465191A96AC89E0DF42D317A6B3FC9EDBD91F0D66D98F
Malicious:	false
Preview:	LPKSHHRH...................Bg.H....{..f...................................Bg.H....{..f........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31Hl0t8/uTlt/Wt8/uTlPX:F3Et8myt8mJ
MD5:	AFC6060B6D8CBCB1D5EB4D37E2DCF857
SHA1:	0C74DCAFD3860632DD708EAA75694939889EB4FD
SHA-256:	8FE8075B4D820AFB6F581E48C19C2C3BAE17A3B15E192BE8BB53FA9579AD6B7F
SHA-512:	0122742DA7F75D1FC6303256B6C088983F536918661C38BCE3813729DC495C2A64299AB6C617D43D8A2876E4E625885B6700F012598B8FCCF6D44BF262B51D66
Malicious:	false
Preview:	LPKSHHRH.................Ea.#H......6...................................Ea.#H......6..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	1220
Entropy (8bit):	4.663648001243497
Encrypted:	false
SSDEEP:	24:KaRyAICpXJeCaRrAIb6abLTAIbsadqnAIlpfajTAIEiaYAIEVa4AIhWLafAIGAKk:KaKCpZeCaDb6aVbsaAJlpfajtEiaWEVP
MD5:	3696D517CF840CF2BD71BADE3269E3FE
SHA1:	917ABA00AEA002CD7EF90FB6A826445CEDD22A68
SHA-256:	9D5A6FE8A95AE1F96EEB79D70D4A82E318037A695BD8863451660F7FE5AD5615
SHA-512:	BEDA4B74D58BC04F1E5B00F5810D580F99FEBA83459388E1A3B4BF3B260AB9687B2D1EE72706555E940919DBED93836EFE26AE0EBAA08D585D986C033B497A19
Malicious:	false
Preview:	Aug 29 01:45:59 galassia kernel: [ 599.512280] New task spawned: old: (tgid 7064, tid 7064), new (tgid: 7066, tid: 7066).Aug 29 01:45:59 galassia kernel: [ 600.268659] New task spawned: old: (tgid 7067, tid 7067), new (tgid: 7067, tid: 7069).Aug 29 01:45:59 galassia kernel: [ 600.269175] New task spawned: old: (tgid 7067, tid 7067), new (tgid: 7067, tid: 7070).Aug 29 01:45:59 galassia kernel: [ 600.289952] New task spawned: old: (tgid 7067, tid 7070), new (tgid: 7067, tid: 7071).Aug 29 01:45:59 galassia kernel: [ 600.390187] New task spawned: old: (tgid 7068, tid 7068), new (tgid: 7068, tid: 7072).Aug 29 01:45:59 galassia kernel: [ 600.390755] New task spawned: old: (tgid 7068, tid 7068), new (tgid: 7068, tid: 7073).Aug 29 01:45:59 galassia kernel: [ 600.392960] New task spawned: old: (tgid 7068, tid 7072), new (tgid: 7068, tid: 7074).Aug 29 01:45:59 galassia kernel: [ 600.751614] New task spawned: old: (tgid 7051, tid 7051), new (tgid: 7075, tid: 7075).Aug 29 01:45:59 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2995
Entropy (8bit):	5.0846647349553304
Encrypted:	false
SSDEEP:	48:KX3C7Xh1VdyT6TCGPqlc0lsRyaKCpZeCaDb6aVbsaAJlpfajtEiaWEVElrr6WC7O:L287R9pZu9SPpXDXrsNJkNfoWhJzm
MD5:	EAA456EC8C96C88F8E85116835BC7790
SHA1:	55DC6B58DC440E83DED5EB869A19D604E8A73A18
SHA-256:	888BACA76F7B8AAE76171DA39AC8E681E4AD95DB53917D26DACEEBA0EA0A1340
SHA-512:	B98079D3C90039B59705B6FE396629A5D87225C8B1E5531AF6B4B5E8EE84E42EAAF93252957FA4D59F1F377B299F04F4D571C06B7F1967D973F7FDA65DA9F60F
Malicious:	false
Preview:	Aug 29 01:45:58 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Aug 29 01:45:58 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Aug 29 01:45:59 galassia dbus-daemon[6986]: [system] Activating via systemd: service name='org.freedesktop.PolicyKit1' unit='polkit.service' requested by ':1.5' (uid=0 pid=7056 comm="/usr/lib/accountsservice/accounts-daemon " label="unconfined").Aug 29 01:45:59 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 6..Aug 29 01:45:59 galassia systemd[1]: Starting Authorization Manager....Aug 29 01:45:59 galassia systemd[1]: Stopped System Logging Service..Aug 29 01:45:59 galassia systemd[1]: Starting System Logging Service....Aug 29 01:45:59 galassia kernel: [ 599.512280] New task spawned: old: (tgid 7064, tid 7064), new (tgid: 7066, tid: 7066).Aug 29 01:45:59 galassia kernel: [ 600.268659] New task spawned: old: (tgid 7067, tid 7067), new (tgid: 7067, tid: 7069).Aug 29 01:4

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:nCsXlXEWtl/xlLDz4:nf+ylJl3z4
MD5:	905321CB890796C5ECF503C8E4D0EA2D
SHA1:	3DE3B7774F3E8B0BE2711990B9EDA531C0CBFC1D
SHA-256:	D7D6BD0E9AD12985367F4AEFBC13C6B56F3632F73A184F2DCC1F18DECD7EE040
SHA-512:	A1FAA91BE847C4B7B4DEC0F4EEB079385CA5544E57F7C37E7D721128AE576A532454ABC795F4890A2CAFAC96D34B4D3C668129CCD39D39DE0AD6277BEFFE593F
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................%..f........................................

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.891560019282456
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
File size:	29'352 bytes
MD5:	e65a9ede6db58e9ebf08694cd98f72e4
SHA1:	77c1172bbc46e10b084cfc3922bb8d57838d28c0
SHA256:	94f2fb819755ec3eaf44c3c74e570bc47fbfbfcee984db35376cd014219e517c
SHA512:	e2d71320a4febf10c022fb76475a192af4cf5c8825f19e3396d2250b94e721bdefc5382721de4866448bda299dc092cedba29b81bf7a81310740fb511cc1e266
SSDEEP:	768:2QhKAtI3M1xzce0EvFI5pEl0aNRZZUMlbJJgGlzDpbuR1JXZ:NwAeS30YW5pEltZ9p7VJub
TLSH:	6ED2D00D0B160CD4D525447DAF6607F00AA22F7386175A5B781FEA82DFE39D8A882FD5
File Content Preview:	.ELF......................^@...4.........4. ...(......................q...q...............9`.E9`.E9`................D$.RUPX!.h........7`..7`.......T.......?.E.h4...@b..) ..]....E...c. G.r.....].5<..W.n9l...~.t...-...7...?..9.V...*<.. L.../L..[............

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x105e40
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0x7184	0x7184	7.8954	0x5	R E	0x10000
LOAD	0x3960	0x453960	0x453960	0x0	0x0	0.0000	0x6	RW	0x10000

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 08:43:24.396586895 CEST	192.168.2.23	8.8.8.8	0xfbe3	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:43:24.396627903 CEST	192.168.2.23	8.8.8.8	0x2aae	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:43:24.731379032 CEST	192.168.2.23	8.8.8.8	0x6617	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:44:45.756716967 CEST	192.168.2.23	8.8.8.8	0xab8b	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:44:45.756771088 CEST	192.168.2.23	8.8.8.8	0xb3b0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:45:02.991446972 CEST	192.168.2.23	8.8.8.8	0xfe88	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:45:16.985227108 CEST	192.168.2.23	8.8.8.8	0xa948	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:16.985305071 CEST	192.168.2.23	8.8.8.8	0x180d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:45:37.374114037 CEST	192.168.2.23	8.8.8.8	0x9221	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:37.374155045 CEST	192.168.2.23	8.8.8.8	0x82ae	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:45:40.197690964 CEST	192.168.2.23	8.8.8.8	0xdb2a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Aug 29, 2024 08:45:56.372910023 CEST	192.168.2.23	8.8.8.8	0x8bec	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 08:43:24.407332897 CEST	8.8.8.8	192.168.2.23	0xfbe3	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:43:24.407332897 CEST	8.8.8.8	192.168.2.23	0xfbe3	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:44:45.763113976 CEST	8.8.8.8	192.168.2.23	0xab8b	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:44:45.763113976 CEST	8.8.8.8	192.168.2.23	0xab8b	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:16.991595030 CEST	8.8.8.8	192.168.2.23	0xa948	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:16.991595030 CEST	8.8.8.8	192.168.2.23	0xa948	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:37.380861998 CEST	8.8.8.8	192.168.2.23	0x9221	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Aug 29, 2024 08:45:37.380861998 CEST	8.8.8.8	192.168.2.23	0x9221	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-08-29 06:43:28 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-08-29 06:43:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-08-29 06:43:28 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-08-29 06:43:28 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 29 Aug 2024 06:43:28 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 977 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	06:42:47
Start date (UTC):	29/08/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
Arguments:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	06:43:02
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:04
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:21
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:23
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:24
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:25
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:26
Start date (UTC):	29/08/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	06:43:27
Start date (UTC):	29/08/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	06:43:28
Start date (UTC):	29/08/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	06:43:31
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:41
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:43:43
Start date (UTC):	29/08/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	06:43:44
Start date (UTC):	29/08/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6453/oom_score_adj

/proc/6862/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:755236mKsBc

/run/systemd/journal/streams/.#9:755244sjdn9

/run/systemd/journal/streams/.#9:75869KpdN2b

/run/systemd/journal/streams/.#9:75903xY8ec9

/run/systemd/journal/streams/.#9:75914jNVOhc

/run/systemd/journal/streams/.#9:759216KWSSb

/run/systemd/journal/streams/.#9:75923MBsj48

/run/systemd/journal/streams/.#9:762030eQb98

/run/systemd/journal/streams/.#9:763286aAPyc

/run/systemd/journal/streams/.#9:7636345Anx9

/run/systemd/journal/streams/.#9:76984v1LJI8

/run/systemd/journal/streams/.#9:77502GCr2ub

/run/systemd/journal/streams/.#9:77505cqgl1a

/run/systemd/journal/streams/.#9:77676p7hWRa

/run/systemd/journal/streams/.#9:77685nAFVHb

/run/systemd/journal/streams/.#9:77806aqt2V8

/run/systemd/journal/streams/.#9:78674YXQNl8

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.11438.19201.elf

Start time (UTC):	06:43:45
Start date (UTC):	29/08/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	06:43:42
Start date (UTC):	29/08/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	06:44:04
Start date (UTC):	29/08/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	06:44:42
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:44:43
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:44:44
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:44:45
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	06:44:46
Start date (UTC):	29/08/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	06:44:47
Start date (UTC):	29/08/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	06:44:48
Start date (UTC):	29/08/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75