Edit tour

Linux Analysis Report
byte.arm5.elf

Overview

General Information

Sample name:	byte.arm5.elf
Analysis ID:	1540130
MD5:	bef45203c68fc3734dd6fd1ad46f3c8b
SHA1:	d00655f9e6da4ea13e26c7b985df909146b35b4d
SHA256:	30d208417c8d64b0787de4a52e6f9c8c8433f4e8003089918705d73e1f8ee9ef
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540130
Start date and time:	2024-10-23 13:30:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.arm5.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/171@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: byte.arm5.elf

Process Tree

system is lnxubuntu20

byte.arm5.elf (PID: 5531, Parent: 5451, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/byte.arm5.elf

byte.arm5.elf New Fork (PID: 5534, Parent: 5531)

byte.arm5.elf New Fork (PID: 5536, Parent: 5531)

byte.arm5.elf New Fork (PID: 5538, Parent: 5531)

byte.arm5.elf New Fork (PID: 5540, Parent: 5538)

byte.arm5.elf New Fork (PID: 5541, Parent: 5538)

byte.arm5.elf New Fork (PID: 5543, Parent: 5538)

byte.arm5.elf New Fork (PID: 5545, Parent: 5538)

byte.arm5.elf New Fork (PID: 5547, Parent: 5538)

systemd New Fork (PID: 5553, Parent: 1)

journalctl (PID: 5553, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5573, Parent: 1)

dbus-daemon (PID: 5573, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5586, Parent: 2955)

pulseaudio (PID: 5586, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5587, Parent: 1)

rsyslogd (PID: 5587, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5588, Parent: 3147)

fusermount (PID: 5588, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5595, Parent: 1)

systemd-journald (PID: 5595, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5599, Parent: 1)

rtkit-daemon (PID: 5599, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5602, Parent: 1)

systemd-logind (PID: 5602, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5661, Parent: 1)

polkitd (PID: 5661, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gdm3 New Fork (PID: 5667, Parent: 1289)

Default (PID: 5667, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5668, Parent: 1289)

Default (PID: 5668, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5669, Parent: 1289)

Default (PID: 5669, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5670, Parent: 1)

agetty (PID: 5670, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5671, Parent: 1)

gpu-manager (PID: 5671, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5672, Parent: 5671)

sh (PID: 5672, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5673, Parent: 5672)

grep (PID: 5673, Parent: 5672, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5674, Parent: 5671)

sh (PID: 5674, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5675, Parent: 5674)

grep (PID: 5675, Parent: 5674, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5677, Parent: 5671)

sh (PID: 5677, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5678, Parent: 5677)

grep (PID: 5678, Parent: 5677, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5679, Parent: 5671)

sh (PID: 5679, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5680, Parent: 5679)

grep (PID: 5680, Parent: 5679, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5681, Parent: 5671)

sh (PID: 5681, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5682, Parent: 5681)

grep (PID: 5682, Parent: 5681, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5687, Parent: 5671)

sh (PID: 5687, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5688, Parent: 5687)

grep (PID: 5688, Parent: 5687, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5689, Parent: 5671)

sh (PID: 5689, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5690, Parent: 5689)

grep (PID: 5690, Parent: 5689, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5691, Parent: 5671)

sh (PID: 5691, Parent: 5671, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5692, Parent: 5691)

grep (PID: 5692, Parent: 5691, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5686, Parent: 2955)

dbus-daemon (PID: 5686, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5693, Parent: 1)

journalctl (PID: 5693, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 5696, Parent: 1)

generate-config (PID: 5696, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5697, Parent: 5696)

pkill (PID: 5697, Parent: 5696, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5700, Parent: 1)

gdm-wait-for-drm (PID: 5700, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5705, Parent: 1)

gdm3 (PID: 5705, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5708, Parent: 5705)

plymouth (PID: 5708, Parent: 5705, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5718, Parent: 5705)

gdm-session-worker (PID: 5718, Parent: 5705, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5724, Parent: 5718)

gdm-wayland-session (PID: 5724, Parent: 5718, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5728, Parent: 5724)

dbus-run-session (PID: 5728, Parent: 5724, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5729, Parent: 5728)

dbus-daemon (PID: 5729, Parent: 5728, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5733, Parent: 5729)

dbus-daemon New Fork (PID: 5734, Parent: 5733)

false (PID: 5734, Parent: 5733, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5736, Parent: 5729)

dbus-daemon New Fork (PID: 5737, Parent: 5736)

false (PID: 5737, Parent: 5736, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5738, Parent: 5729)

dbus-daemon New Fork (PID: 5739, Parent: 5738)

false (PID: 5739, Parent: 5738, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5740, Parent: 5729)

dbus-daemon New Fork (PID: 5741, Parent: 5740)

false (PID: 5741, Parent: 5740, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5742, Parent: 5729)

dbus-daemon New Fork (PID: 5743, Parent: 5742)

false (PID: 5743, Parent: 5742, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5744, Parent: 5729)

dbus-daemon New Fork (PID: 5745, Parent: 5744)

false (PID: 5745, Parent: 5744, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5749, Parent: 5729)

dbus-daemon New Fork (PID: 5750, Parent: 5749)

false (PID: 5750, Parent: 5749, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5730, Parent: 5728)

gnome-session (PID: 5730, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5730, Parent: 5728, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5751, Parent: 5730)

session-migration (PID: 5751, Parent: 5730, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5752, Parent: 5730)

sh (PID: 5752, Parent: 5730, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5752, Parent: 5730, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5760, Parent: 5705)

gdm-session-worker (PID: 5760, Parent: 5705, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5765, Parent: 5760)

gdm-x-session (PID: 5765, Parent: 5760, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5767, Parent: 5765)

Xorg (PID: 5767, Parent: 5765, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5767, Parent: 5765, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5767, Parent: 5765, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5778, Parent: 5767)

sh (PID: 5778, Parent: 5767, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5779, Parent: 5778)

xkbcomp (PID: 5779, Parent: 5778, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5997, Parent: 5767)

sh (PID: 5997, Parent: 5767, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5999, Parent: 5997)

xkbcomp (PID: 5999, Parent: 5997, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5784, Parent: 5765)

Default (PID: 5784, Parent: 5765, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5785, Parent: 5765)

dbus-run-session (PID: 5785, Parent: 5765, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5786, Parent: 5785)

dbus-daemon (PID: 5786, Parent: 5785, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5799, Parent: 5786)

dbus-daemon New Fork (PID: 5800, Parent: 5799)

at-spi-bus-launcher (PID: 5800, Parent: 5799, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5805, Parent: 5800)

dbus-daemon (PID: 5805, Parent: 5800, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6165, Parent: 5805)

dbus-daemon New Fork (PID: 6166, Parent: 6165)

at-spi2-registryd (PID: 6166, Parent: 6165, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5828, Parent: 5786)

dbus-daemon New Fork (PID: 5829, Parent: 5828)

false (PID: 5829, Parent: 5828, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5831, Parent: 5786)

dbus-daemon New Fork (PID: 5832, Parent: 5831)

false (PID: 5832, Parent: 5831, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5833, Parent: 5786)

dbus-daemon New Fork (PID: 5834, Parent: 5833)

false (PID: 5834, Parent: 5833, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5835, Parent: 5786)

dbus-daemon New Fork (PID: 5836, Parent: 5835)

false (PID: 5836, Parent: 5835, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5837, Parent: 5786)

dbus-daemon New Fork (PID: 5838, Parent: 5837)

false (PID: 5838, Parent: 5837, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5839, Parent: 5786)

dbus-daemon New Fork (PID: 5840, Parent: 5839)

false (PID: 5840, Parent: 5839, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5842, Parent: 5786)

dbus-daemon New Fork (PID: 5843, Parent: 5842)

false (PID: 5843, Parent: 5842, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6005, Parent: 5786)

dbus-daemon New Fork (PID: 6006, Parent: 6005)

ibus-portal (PID: 6006, Parent: 6005, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6175, Parent: 5786)

dbus-daemon New Fork (PID: 6176, Parent: 6175)

gjs (PID: 6176, Parent: 6175, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6366, Parent: 5786)

dbus-daemon New Fork (PID: 6367, Parent: 6366)

false (PID: 6367, Parent: 6366, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5787, Parent: 5785)

gnome-session (PID: 5787, Parent: 5785, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5787, Parent: 5785, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5788, Parent: 5787)

gnome-session-check-accelerated (PID: 5788, Parent: 5787, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5806, Parent: 5788)

gnome-session-check-accelerated-gl-helper (PID: 5806, Parent: 5788, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5817, Parent: 5788)

gnome-session-check-accelerated-gles-helper (PID: 5817, Parent: 5788, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5844, Parent: 5787)

session-migration (PID: 5844, Parent: 5787, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5845, Parent: 5787)

sh (PID: 5845, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5845, Parent: 5787, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5943, Parent: 5845)

ibus-daemon (PID: 5943, Parent: 5845, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6001, Parent: 5943)

ibus-memconf (PID: 6001, Parent: 5943, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6003, Parent: 5943)

ibus-daemon New Fork (PID: 6004, Parent: 6003)

ibus-x11 (PID: 6004, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6209, Parent: 5943)

ibus-engine-simple (PID: 6209, Parent: 5943, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6191, Parent: 5787)

sh (PID: 6191, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6191, Parent: 5787, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6193, Parent: 5787)

sh (PID: 6193, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6193, Parent: 5787, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6197, Parent: 5787)

sh (PID: 6197, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6197, Parent: 5787, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6198, Parent: 5787)

sh (PID: 6198, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6198, Parent: 5787, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6200, Parent: 5787)

sh (PID: 6200, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6200, Parent: 5787, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6375, Parent: 6200)

gsd-print-notifications New Fork (PID: 6376, Parent: 6375)

gsd-printer (PID: 6376, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6202, Parent: 5787)

sh (PID: 6202, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6202, Parent: 5787, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6204, Parent: 5787)

sh (PID: 6204, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6204, Parent: 5787, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6205, Parent: 5787)

sh (PID: 6205, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6205, Parent: 5787, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6207, Parent: 5787)

sh (PID: 6207, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6207, Parent: 5787, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6210, Parent: 5787)

sh (PID: 6210, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6210, Parent: 5787, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6212, Parent: 5787)

sh (PID: 6212, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6212, Parent: 5787, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6213, Parent: 5787)

sh (PID: 6213, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6213, Parent: 5787, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6217, Parent: 5787)

sh (PID: 6217, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6217, Parent: 5787, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6219, Parent: 5787)

sh (PID: 6219, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6219, Parent: 5787, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6716, Parent: 5787)

sh (PID: 6716, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6716, Parent: 5787, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6726, Parent: 5787)

sh (PID: 6726, Parent: 5787, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6726, Parent: 5787, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5761, Parent: 5705)

Default (PID: 5761, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5762, Parent: 5705)

Default (PID: 5762, Parent: 5705, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5709, Parent: 1)

accounts-daemon (PID: 5709, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5713, Parent: 5709)

language-validate (PID: 5713, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5714, Parent: 5713)

language-options (PID: 5714, Parent: 5713, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5715, Parent: 5714)

sh (PID: 5715, Parent: 5714, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5716, Parent: 5715)

locale (PID: 5716, Parent: 5715, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5717, Parent: 5715)

grep (PID: 5717, Parent: 5715, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5726, Parent: 1299)

dbus-daemon (PID: 5726, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5867, Parent: 1)

systemd-localed (PID: 5867, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6014, Parent: 1)

upowerd (PID: 6014, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6052, Parent: 1299)

pulseaudio (PID: 6052, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6055, Parent: 1)

geoclue (PID: 6055, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6167, Parent: 1)

wpa_supplicant (PID: 6167, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6171, Parent: 1)

avahi-daemon (PID: 6171, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6174, Parent: 6171)

systemd New Fork (PID: 6172, Parent: 1)

packagekitd (PID: 6172, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6199, Parent: 6172)

dpkg (PID: 6199, Parent: 6172, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6235, Parent: 1)

systemd-hostnamed (PID: 6235, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6413, Parent: 1)

fprintd (PID: 6413, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 6519, Parent: 1)

colord (PID: 6519, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6720, Parent: 6519)

colord-sane (PID: 6720, Parent: 6519, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6524, Parent: 1)

ModemManager (PID: 6524, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6557, Parent: 1)

systemd-localed (PID: 6557, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
byte.arm5.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security

Memory Dumps

Source	Rule	Description	Author
5531.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5541.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5538.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5536.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5534.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5540.1.00007f38b8017000.00007f38b802a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5531	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5534	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5536	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5538	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5540	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm5.elf PID: 5541	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 7 entries

String: byte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnesi

Source: global traffic

TCP traffic: 192.168.2.14:53466 -> 154.216.18.116:777

Source: /usr/sbin/rsyslogd (PID: 5587)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5595)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5705)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5729)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5730)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5767)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5786)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5805)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5787)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5943)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 170.77.26.107
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.212.255
Source: unknown	TCP traffic detected without corresponding DNS query: 169.107.240.106
Source: unknown	TCP traffic detected without corresponding DNS query: 133.16.131.24
Source: unknown	TCP traffic detected without corresponding DNS query: 138.69.98.137
Source: unknown	TCP traffic detected without corresponding DNS query: 198.134.28.162
Source: unknown	TCP traffic detected without corresponding DNS query: 189.99.183.104
Source: unknown	TCP traffic detected without corresponding DNS query: 169.169.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 169.72.241.226
Source: unknown	TCP traffic detected without corresponding DNS query: 150.123.137.202
Source: unknown	TCP traffic detected without corresponding DNS query: 137.37.8.210
Source: unknown	TCP traffic detected without corresponding DNS query: 169.124.133.234
Source: unknown	TCP traffic detected without corresponding DNS query: 199.66.155.57
Source: unknown	TCP traffic detected without corresponding DNS query: 103.131.20.240
Source: unknown	TCP traffic detected without corresponding DNS query: 92.114.140.9
Source: unknown	TCP traffic detected without corresponding DNS query: 101.152.1.179
Source: unknown	TCP traffic detected without corresponding DNS query: 18.163.52.109
Source: unknown	TCP traffic detected without corresponding DNS query: 73.8.182.66
Source: unknown	TCP traffic detected without corresponding DNS query: 42.219.63.233
Source: unknown	TCP traffic detected without corresponding DNS query: 98.104.199.227
Source: unknown	TCP traffic detected without corresponding DNS query: 17.90.179.140
Source: unknown	TCP traffic detected without corresponding DNS query: 70.156.105.120
Source: unknown	TCP traffic detected without corresponding DNS query: 180.247.58.134
Source: unknown	TCP traffic detected without corresponding DNS query: 34.140.240.247
Source: unknown	TCP traffic detected without corresponding DNS query: 117.163.96.12
Source: unknown	TCP traffic detected without corresponding DNS query: 220.112.40.167
Source: unknown	TCP traffic detected without corresponding DNS query: 40.216.20.141
Source: unknown	TCP traffic detected without corresponding DNS query: 156.3.206.122
Source: unknown	TCP traffic detected without corresponding DNS query: 64.178.48.120
Source: unknown	TCP traffic detected without corresponding DNS query: 183.0.129.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.220.88.5
Source: unknown	TCP traffic detected without corresponding DNS query: 200.128.120.154
Source: unknown	TCP traffic detected without corresponding DNS query: 91.81.84.106
Source: unknown	TCP traffic detected without corresponding DNS query: 217.18.156.85
Source: unknown	TCP traffic detected without corresponding DNS query: 119.73.28.47
Source: unknown	TCP traffic detected without corresponding DNS query: 189.43.82.215
Source: unknown	TCP traffic detected without corresponding DNS query: 17.182.250.194
Source: unknown	TCP traffic detected without corresponding DNS query: 183.96.138.97
Source: unknown	TCP traffic detected without corresponding DNS query: 36.36.251.84
Source: unknown	TCP traffic detected without corresponding DNS query: 12.57.18.16
Source: unknown	TCP traffic detected without corresponding DNS query: 91.225.132.163
Source: unknown	TCP traffic detected without corresponding DNS query: 53.75.61.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.155.152.130
Source: unknown	TCP traffic detected without corresponding DNS query: 24.189.146.213
Source: unknown	TCP traffic detected without corresponding DNS query: 159.113.36.49
Source: unknown	TCP traffic detected without corresponding DNS query: 66.242.245.48
Source: unknown	TCP traffic detected without corresponding DNS query: 190.186.171.21
Source: unknown	TCP traffic detected without corresponding DNS query: 47.233.216.133
Source: unknown	TCP traffic detected without corresponding DNS query: 118.247.82.153
Source: unknown	TCP traffic detected without corresponding DNS query: 193.80.55.236

Source: global traffic

DNS traffic detected: DNS query: asdffasdfasdfas.o-r.kr

Source: Xorg.0.log.157.dr, syslog.28.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.157.dr, syslog.28.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.28.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1309, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1364, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1382, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2946, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3884, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5368, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5514, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5515, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5538, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 785, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 791, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1364, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1382, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2946, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3884, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5368, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5514, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5515, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5534, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 5799, result: successful
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 6005, result: successful
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 6175, result: successful
Source: /usr/bin/dbus-daemon (PID: 5805)	SIGKILL sent: pid: 6165, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: byte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GR

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1309, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1364, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1382, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2946, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3147, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 3884, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5368, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5514, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5515, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	SIGKILL sent: pid: 5538, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 785, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 791, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1364, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1382, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2946, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 3884, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5368, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5514, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5515, result: no such process	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	SIGKILL sent: pid: 5534, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 5799, result: successful
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 6005, result: successful
Source: /usr/bin/dbus-daemon (PID: 5786)	SIGKILL sent: pid: 6175, result: successful
Source: /usr/bin/dbus-daemon (PID: 5805)	SIGKILL sent: pid: 6165, result: successful

Source: classification engine

Classification label: mal76.spre.troj.linELF@0/171@2/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5573)	File: /proc/5573/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5588)	File: /proc/5588/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5686)	File: /proc/5686/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5729)	File: /proc/5729/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5786)	File: /proc/5786/mounts
Source: /usr/bin/dbus-daemon (PID: 5805)	File: /proc/5805/mounts
Source: /usr/bin/gjs (PID: 6176)	File: /proc/6176/mounts
Source: /usr/bin/gnome-shell (PID: 5845)	File: /proc/5845/mounts
Source: /usr/bin/dbus-daemon (PID: 5726)	File: /proc/5726/mounts

Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:66451QKUOYh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:66487bUFOng	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:66490PTsbEg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:66509YwOgCi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:66511sP1QUi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:67993DnNdHh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:680680IWLhi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:680695wu5Re	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:68078vJYT1e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:68081Ye1J5g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:6808572KFZg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:68086wp68Oi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:682117RBtVh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69723nGLfmh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69841WxgJMf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:700173BOAti	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:700236Gbrzf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:702289rO4Ig	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:70229oCFE0g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:702351CupDe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:70249aIhzkg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69245QxUG3e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69247nIWVRi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69306G5xD3g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:693081xF7ue	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69357uLRoxg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:69361H73Y7h	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File: /run/systemd/journal/streams/.#9:71889CpE0Ze	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0zgWYLP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127u8nvkM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127yRcgIP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0zav8UN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127Y1EkWL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1YdYQAL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127omnxsP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0py0yHL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127aAxFhO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1DjNWUO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1q6QMnM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127hwdDKN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1WDvmRP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1QPLgSM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c1CYfrYN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#1271MaWjM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0ItxKjL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#1270pEM9N	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0Ji53AO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127cdKycL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0Mw4u8L	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127sI5WjP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2AZhZRL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127iIzdGO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/seats/.#seat0FPtjKM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c27M6cbL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2ewgpoP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/users/.#127exKcNM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2POyTBN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2dgAnDL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2UHVQCO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2iCUr8M	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/sessions/.#c2yoSCUN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/inhibit/.#13dwZiL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/inhibit/.#2c4iWfO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/inhibit/.#3tPB5mP	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/inhibit/.#4WcvlCO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5602)	File: /run/systemd/inhibit/.#5BizFzL	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5752)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5752)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 5767)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5767)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5788)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5788)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5788)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5806)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5817)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5817)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5817)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5845)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6004)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6004)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6193)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6193)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6197)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6197)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6198)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6198)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6202)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6202)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6219)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6219)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5709)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5709)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6014)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6014)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6172)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6235)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6519)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6524)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6524)	Directory: <invalid fd (11)>/..

Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/2991/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1382/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/791/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/797/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1299/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/3157/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/5534/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/5514/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/5515/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/2946/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/780/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/3094/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/2955/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/661/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1589/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/785/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/940/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1289/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1300/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/3147/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1364/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/767/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/5368/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/801/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/3884/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/725/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/769/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/1309/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5540)	File opened: /proc/2956/net/tcp	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6197/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6197/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6198/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6198/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5586/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5586/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5586/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6052/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6052/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6052/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5787/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5787/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6207/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6207/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/5845/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6219/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5661)	File opened: /proc/6219/cgroup	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/5540/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/490/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1382/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/791/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/797/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1299/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/3157/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/5514/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/5515/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/5538/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/2946/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/780/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/3094/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/2955/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/661/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/782/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1589/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/785/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/940/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1289/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1300/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/3147/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1364/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/767/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/5368/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/801/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/3884/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/725/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/769/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/726/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/1309/net/tcp	Jump to behavior
Source: /tmp/byte.arm5.elf (PID: 5534)	File opened: /proc/2956/net/tcp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5661/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	File opened: /proc/5586/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5672)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5674)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5677)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5679)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5681)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5687)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5689)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5691)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5778)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5997)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5715)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5673)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5675)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5678)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5680)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5682)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5688)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5690)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5692)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5717)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5697)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5595)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 5670)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5705)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5705)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5709)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5709)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5587)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5587)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5671)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5767)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5671)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5767)	Truncated file: /var/log/Xorg.pid-5767.log

Source: /usr/bin/pulseaudio (PID: 5586)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5767)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5788)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5806)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5817)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5845)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6052)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/byte.arm5.elf (PID: 5531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5586)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5587)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5595)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5670)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5671)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5718)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5760)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5765)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5767)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5800)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6166)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5787)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5788)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5806)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5817)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5845)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6004)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6193)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6197)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6198)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6204)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6207)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6219)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6052)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6171)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6172)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6235)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6413)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6720)	Queries kernel information via 'uname':

Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.841] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.460] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.139] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.035] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.704] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.389] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.118] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.479] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.913] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.087] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.597] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.538] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.728] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.166] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.862] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.565] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.759] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.370] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.980] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.170] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.180] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.304] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.496] (==) vmware(0): DPI set to (96, 96)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.293] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.383] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.204] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.255] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.441] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.469] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): vis: 4
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.881] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.472] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.566] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.464] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.845] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.435] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.583] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): depth: 24
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.890] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.232] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.354] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.480] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.385] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.110] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:06 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.568] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.968] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.365] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.069] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.981] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.924] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.327] (--) vmware(0): bpp: 32
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.399] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.354] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.772] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.603] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.280] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.496] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.525] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.455] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.831] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.907] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 182.603] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.939] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: byte.arm5.elf, 5531.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5534.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5536.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5538.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5540.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5541.1.000056314ec76000.000056314eda4000.rw-.sdmp	Binary or memory string: N1V!/etc/qemu-binfmt/arm
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.982] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.657] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.056] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.220] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.436] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.033] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.941] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.359] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.672] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.805] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.577] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.745] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.424] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.270] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 182.615] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.094] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.343] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.418] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.404] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.352] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.835] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.047] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.308] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.474] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.446] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.532] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): w.grn: 8
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.605] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.221] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.278] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.556] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 179.051] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.991] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 178.612] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.555] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.678] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.502] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.544] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.841] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): vram: 4194304
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.509] (==) vmware(0): RGB weight 888
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.691] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.578] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.146] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.848] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.624] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.373] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.575] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.451] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.750] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.481] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.399] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.459] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.344] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.043] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.185] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.328] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 182.572] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.920] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.948] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.830] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.672] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.403] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.201] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.440] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.030] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Using HW cursor
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.948] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.965] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.081] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.409] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.318] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.335] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.868] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.835] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.760] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.144] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): mheig: 885
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.373] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.243] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.142] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.762] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.313] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:06 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.043] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.161] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:21 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.694] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.588] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.354] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.022] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.275] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.852] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.278] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.711] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.337] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.782] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.277] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.960] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.427] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.377] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.191] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.898] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.167] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.027] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.199] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.611] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.377] (--) vmware(0): mwidt: 1176
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.212] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.172] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.056] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.332] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.567] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.088] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.738] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.550] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.834] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.233] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.648] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:21 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:21 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.465] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.278] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.182] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.008] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.678] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.441] (--) vmware(0): w.grn: 8
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.819] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.658] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.347] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.394] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.557] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.931] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.420] (--) vmware(0): bpp: 32
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.076] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.224] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.661] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.681] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.642] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:21 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.341] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.286] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.062] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.145] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 178.072] (II) LoadModule: "vmware"
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.394] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: byte.arm5.elf, 5531.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5534.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5536.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5538.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5540.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5541.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 182.623] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.597] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.865] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.299] (--) vmware(0): depth: 24
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.287] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.446] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.199] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.310] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.375] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.729] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.526] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.787] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): bpp: 32
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (WW) vmware(0): Disabling 3D support.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.193] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.629] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.413] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 182.593] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.129] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.244] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.393] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.514] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.758] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.797] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 178.203] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.325] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.217] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.823] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.075] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.384] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.959] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.062] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.068] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.522] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.535] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.418] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.300] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.170] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): w.blu: 8
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.006] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.969] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.536] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.365] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.483] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.382] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.775] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.452] (--) vmware(0): w.blu: 8
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.467] (--) vmware(0): vis: 4
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.410] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.715] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.224] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:06 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.113] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.318] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.359] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.037] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.297] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.739] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.885] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.298] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.252] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.791] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.803] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.268] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.686] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.333] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.852] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:07 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.956] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.492] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.685] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.637] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.374] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.184] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.108] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.327] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 194.101] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.578] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.239] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: byte.arm5.elf, 5531.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5534.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5536.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5538.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5540.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp, byte.arm5.elf, 5541.1.00007ffc0fbdc000.00007ffc0fbfd000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/byte.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/byte.arm5.elf
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.686] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.566] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.956] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.464] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 178.022] (==) Matched vmware as autoconfigured driver 0
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:06 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) LoadModule: "vmware"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.160] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.475] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.391] (--) vmware(0): mheig: 885
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.431] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.800] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.367] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 186.903] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.991] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:15 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.488] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.433] (--) vmware(0): w.red: 8
Source: Xorg.0.log.157.dr	Binary or memory string: [ 193.927] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.368] (--) vmware(0): pbase: 0xe8000000
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.515] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 187.031] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.609] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.379] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: byte.arm5.elf, 5531.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5534.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5536.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5538.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5540.1.000056314ec76000.000056314eda4000.rw-.sdmp, byte.arm5.elf, 5541.1.000056314ec76000.000056314eda4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:13 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.748] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.288] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:12 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 184.560] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 183.401] (--) vmware(0): depth: 24
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:11 galassia /usr/lib/gdm3/gdm-x-session[5767]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.595] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 188.758] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:22 galassia /usr/lib/gdm3/gdm-x-session[5767]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:14 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:17 galassia /usr/lib/gdm3/gdm-x-session[5767]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.612] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.28.dr	Binary or memory string: Oct 23 06:32:16 galassia /usr/lib/gdm3/gdm-x-session[5767]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.744] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.157.dr	Binary or memory string: [ 185.256] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5709)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: byte.arm5.elf, type: SAMPLE
Source: Yara match	File source: 5531.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5538.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5534.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5540.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5534, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5541, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: byte.arm5.elf, type: SAMPLE
Source: Yara match	File source: 5531.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5541.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5538.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5536.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5534.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5540.1.00007f38b8017000.00007f38b802a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5534, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5538, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm5.elf PID: 5541, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
byte.arm5.elf	50%	ReversingLabs	Linux.Backdoor.Bushido
byte.arm5.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
asdffasdfasdfas.o-r.kr	154.216.18.116	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.28.dr	false	unknown
http://wiki.x.org	Xorg.0.log.157.dr, syslog.28.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.157.dr, syslog.28.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
19.162.94.248	unknown	United States	3	MIT-GATEWAYSUS	false
89.222.49.36	unknown	United Kingdom	34914	SYNTEC-ASGB	false
102.32.216.248	unknown	South Africa	327782	METROFIBRE-NETWORXZA	false
67.206.198.147	unknown	Puerto Rico	11992	CENTENNIAL-PR	false
61.75.2.227	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
163.139.130.80	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
179.255.140.99	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
165.148.133.173	unknown	South Africa	5734	TIENETZA	false
151.83.59.212	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
18.240.63.163	unknown	United States	16509	AMAZON-02US	false
208.209.169.127	unknown	United States	2828	XO-AS15US	false
84.238.217.76	unknown	Bulgaria	47402	MULTIMEDIA-ASBG	false
51.67.196.86	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
161.20.120.131	unknown	Switzerland	19512	LYONDELLUS	false
23.89.242.133	unknown	United States	18978	ENZUINC-US	false
74.32.182.169	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
108.31.206.203	unknown	United States	701	UUNETUS	false
60.229.90.142	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
78.64.138.206	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
148.25.28.33	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
169.82.172.46	unknown	United States	37611	AfrihostZA	false
206.86.12.76	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
84.230.35.105	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
198.176.29.37	unknown	United States	46785	QUASAR-DATA-CENTERUS	false
132.215.179.143	unknown	Canada	376	RISQ-ASCA	false
209.193.118.30	unknown	Reserved	36026	AS-CHI-CORPUS	false
213.236.241.66	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
186.232.116.106	unknown	Brazil	53190	PLUGTelecomBR	false
133.15.0.19	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
74.155.201.79	unknown	United States	7922	COMCAST-7922US	false
86.155.54.78	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
190.156.168.110	unknown	Colombia	10620	TelmexColombiaSACO	false
8.20.144.75	unknown	United States	35873	MOVE-NETWORKSUS	false
161.244.153.102	unknown	United States	396269	BPL-ASNUS	false
145.74.74.15	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
148.168.243.9	unknown	United States	11971	PFIZERNET-GROTONUS	false
190.46.122.39	unknown	Chile	22047	VTRBANDAANCHASACL	false
111.67.13.21	unknown	Australia	55803	DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU	false
132.71.160.237	unknown	Israel	378	MACHBA-ASILANIL	false
176.16.144.97	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
35.204.222.215	unknown	United States	15169	GOOGLEUS	false
13.156.87.32	unknown	United States	7018	ATT-INTERNET4US	false
50.144.231.89	unknown	United States	7922	COMCAST-7922US	false
75.196.97.153	unknown	United States	22394	CELLCOUS	false
97.65.109.215	unknown	United States	3549	LVLT-3549US	false
212.38.198.222	unknown	Poland	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
150.177.115.9	unknown	United States	1480	DNIC-AS-01480US	false
42.171.142.161	unknown	China	4249	LILLY-ASUS	false
152.39.223.133	unknown	United States	81	NCRENUS	false
67.39.23.228	unknown	United States	7018	ATT-INTERNET4US	false
19.204.127.250	unknown	United States	3	MIT-GATEWAYSUS	false
52.80.45.180	unknown	China	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
98.72.203.148	unknown	United States	7018	ATT-INTERNET4US	false
171.255.201.76	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
94.104.120.128	unknown	Belgium	47377	ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired	false
121.87.195.85	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
75.185.242.45	unknown	United States	10796	TWC-10796-MIDWESTUS	false
201.11.89.168	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
19.6.61.251	unknown	United States	3	MIT-GATEWAYSUS	false
168.237.232.207	unknown	United States	3136	STATE-OF-WISCONSIN-AS1US	false
25.188.130.81	unknown	United Kingdom	7922	COMCAST-7922US	false
69.155.249.2	unknown	United States	7018	ATT-INTERNET4US	false
140.233.180.151	unknown	United States	14550	MIDDLEBURY-COLLEGEUS	false
42.174.223.171	unknown	China	4249	LILLY-ASUS	false
123.233.53.244	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
188.12.211.190	unknown	Italy	3269	ASN-IBSNAZIT	false
201.41.82.39	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
38.89.2.62	unknown	United States	174	COGENT-174US	false
216.227.170.155	unknown	United States	174	COGENT-174US	false
150.169.40.148	unknown	United States	21982	PRDCA-ASNUS	false
20.170.72.205	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
70.160.227.206	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
34.115.33.112	unknown	United States	19527	GOOGLE-2US	false
200.98.219.209	unknown	Brazil	18479	UniversoOnlineSABR	false
223.66.110.148	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
92.154.45.138	unknown	France	3215	FranceTelecom-OrangeFR	false
63.168.236.19	unknown	United States	1239	SPRINTLINKUS	false
173.249.236.51	unknown	United States	11878	TZULOUS	false
158.105.158.177	unknown	Sweden	28726	ASN-EVRY-UNIGRIDSE	false
180.173.10.153	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
194.80.178.240	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
219.157.20.176	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
13.130.171.163	unknown	United States	7018	ATT-INTERNET4US	false
108.90.130.135	unknown	United States	7018	ATT-INTERNET4US	false
148.234.248.126	unknown	Mexico	3454	UniversidadAutonomadeNuevoLeonMX	false
137.77.39.114	unknown	United States	688	RECNET-ASUS	false
170.176.254.210	unknown	United States	16433	NCTC-ISPUS	false
200.245.0.102	unknown	Brazil	4230	CLAROSABR	false
203.138.245.112	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
175.26.14.20	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
183.252.167.224	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
148.225.40.98	unknown	Mexico	4493	UniversidaddeSonoraMX	false
95.214.171.249	unknown	Germany	398083	TING-WIRELESSUS	false
186.152.31.255	unknown	Argentina	7303	TelecomArgentinaSAAR	false
63.234.57.3	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
163.195.56.98	unknown	South Africa	37130	SITA-ASZA	false
88.220.241.92	unknown	Poland	20804	ASN-TELENERGOulPERKUNA47WARSZAWAPL	false
13.217.246.9	unknown	United States	16509	AMAZON-02US	false
52.80.45.163	unknown	China	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
171.69.168.85	unknown	United States	109	CISCOSYSTEMSUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.222.49.36	na.elf	Get hash	malicious	Mirai	Browse
89.222.49.36	na.elf	Get hash	malicious	Mirai	Browse
102.32.216.248	MkVtdxCh13	Get hash	malicious	Unknown	Browse
67.206.198.147	tLXBiZMcFJ.elf	Get hash	malicious	Mirai	Browse
	0P7v2jNkBV	Get hash	malicious	Mirai	Browse
	apep.x86	Get hash	malicious	Mirai	Browse
78.64.138.206	jboc00A6YP.elf	Get hash	malicious	Mirai	Browse
	WP8ptkXRlY.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
61.75.2.227	v78XF1DWG0	Get hash	malicious	Mirai	Browse
169.82.172.46	DGSmsv9obZ.elf	Get hash	malicious	Mirai	Browse
165.148.133.173	Ma4NfFTyMr.elf	Get hash	malicious	Mirai	Browse
208.209.169.127	xYFPBfWEN0	Get hash	malicious	Mirai	Browse
84.238.217.76	r6vaw1.x86.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	18.66.102.85
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ftejasviolin.com%2Fcharlieir%2FXHVsNVYTNZSjG4S2Sb86eRml/amNoaW5mb0BqdW1laXJhaC5jb20=	Get hash	malicious	HTMLPhisher	Browse	18.173.205.117
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	19.98.251.11
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	19.205.31.81
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	19.124.232.131
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	19.232.72.0
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	19.194.56.93
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	19.182.35.198
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	18.108.101.6
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	19.251.140.94
METROFIBRE-NETWORXZA	YsI7t2OC5q.elf	Get hash	malicious	Mirai	Browse	102.32.216.241
	IB260MBscv.elf	Get hash	malicious	Unknown	Browse	102.33.206.118
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	102.33.206.37
	hmips-20240623-1326.elf	Get hash	malicious	Mirai	Browse	102.32.216.234
	arm7-20240623-0650.elf	Get hash	malicious	Mirai	Browse	102.33.118.180
	Rn1AkuRExh.elf	Get hash	malicious	Mirai	Browse	102.32.216.227
	CnqpVfDyUH.elf	Get hash	malicious	Mirai	Browse	102.32.216.210
	NRxJduEvLG.elf	Get hash	malicious	Mirai	Browse	102.33.118.154
	gt4t3NAdEr.elf	Get hash	malicious	Mirai	Browse	102.32.216.213
	xfO72LuQ7K.elf	Get hash	malicious	Unknown	Browse	196.50.245.225
SYNTEC-ASGB	na.elf	Get hash	malicious	Mirai	Browse	89.222.49.36
	na.elf	Get hash	malicious	Mirai	Browse	89.222.49.36
	na.elf	Get hash	malicious	Mirai	Browse	89.222.49.18
	na.elf	Get hash	malicious	Mirai	Browse	89.222.49.23
	KKveTTgaAAsecNNaaaa.sh4.elf	Get hash	malicious	Unknown	Browse	89.222.98.22
	sora.arm.elf	Get hash	malicious	Mirai	Browse	89.222.9.123
	mpsl.elf	Get hash	malicious	Mirai	Browse	89.222.49.43
	nTDlOKAKOW.elf	Get hash	malicious	Unknown	Browse	89.222.25.18
	thOKPMihQ6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.222.50.29
	P1yfBDlNzh.elf	Get hash	malicious	Mirai	Browse	89.222.50.29
CENTENNIAL-PR	sora.x86.elf	Get hash	malicious	Mirai	Browse	67.206.198.158
	205.185.120.123-skid.mpsl-2024-07-27T08_45_37.elf	Get hash	malicious	Mirai, Moobot	Browse	173.211.164.170
	Rk8eOo7oOz.elf	Get hash	malicious	Unknown	Browse	76.76.203.143
	SecuriteInfo.com.Linux.Siggen.9999.27109.28207.elf	Get hash	malicious	Mirai	Browse	12.205.84.20
	97zyqEu4Nh.elf	Get hash	malicious	Moobot	Browse	173.211.164.155
	1PfkUPbqjw.elf	Get hash	malicious	Mirai	Browse	67.206.198.167
	vb75H26uOr.elf	Get hash	malicious	Mirai	Browse	67.203.209.176
	zpIXM3FqqH.elf	Get hash	malicious	Mirai	Browse	67.203.209.199
	dzGNEiI3d8.elf	Get hash	malicious	Mirai	Browse	65.38.192.206
	yCUczQYIGe.elf	Get hash	malicious	Mirai	Browse	67.206.198.143

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5734/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5737/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5739/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5741/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5743/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5745/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5750/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5800/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5829/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5832/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5834/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5836/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5838/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5840/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5843/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6006/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6166/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6176/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6367/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:/2n:e
MD5:	E0F859304E2F12C8A2740CBAF6581233
SHA1:	CC675F8BD2ABCCAA7E0C78CA2B1A5158B867337E
SHA-256:	369EA4BE56D4948B291942935AAD4AE45BE1FD4E06CD6E75E92DAD34C6E8D7F5
SHA-512:	E96B237C898B9F5ED76DF555C2F9D6BC9A70FDBA3422A4C2B0593A43AA8592B599653249187C068623973461E7491DCC6EE529A479AF77D90A458B771A6E258C
Malicious:	false
Preview:	6171.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:HV6n:16
MD5:	0B429C94094E10A38EB08EFEF19A9F47
SHA1:	FC3A7BE075FE394426D5FAD4DCB694938468A1D9
SHA-256:	60C22306D28AA8E11624D024837073220E2BE562FB02764897B0E20BC7888459
SHA-512:	34DFBE55BF624D5DA51833254BCC26A69CB7E208FF5EC56ED000DC688767BDC0D66E86FB0F2941CC6C0AC9CFF67D424964633A6C107E74F93F41CACEB59981FF
Malicious:	false
Preview:	5705.

/run/systemd/inhibit/.#13dwZiL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifCIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfCApLHK7wR9n
MD5:	35975E532C55E1C11A3442FE61366CA4
SHA1:	761D77624E3485590E5095974CA322E05483EA91
SHA-256:	8D07D8437BE32592B7F9BE047F280007EBA8FAC5A7B29211876AE858DEDD0BFD
SHA-512:	096AAE5DE81905039235D002D877D850F921B10673D08DEEE88B3FD539F55E2D9FAFEBE0A550F588E0ABDB74B2083349552079EA2CAD94DEF01469ECA76B19F9
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6014.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2c4iWfO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.205488082162659
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+bqKLXv0Rsz:qgFqXQXTI1Il+qKjcRsz
MD5:	BC0E44C85EAD517725EFFC33AB127DBF
SHA1:	715926874C30CBAD70C57CC05DE228956B527834
SHA-256:	C643D2F618466FF353F0C64CE8BC93B5089B5027AD7572AB0494EB448B41E013
SHA-512:	479F9C7825806E6D871DEA38CB13479C0BF68C2B9E20748D4829E31E68B993D077E89AF61C253999F3BFEE8B95F5B8ED90B2C8F44723A86E8F22C9F3C3CCA55C
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6207.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3tPB5mP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++7+3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+bqKLXv0RT
MD5:	CF1897BCC5E979BD007C76FC414AD013
SHA1:	0B81B460B327A184071B365D040BBF3E21F8B3DB
SHA-256:	F4C397018CCB806E6B8BFB24EA4804463047A49E9818FBB590EE0D1F498FF541
SHA-512:	4CA737B28EEBBAE6253066A40F77CA53FF9C889709A4CCBA21FDDCE6C12B124080D29BA04EBB145E4A80FA3981C878E591024C2DDE4A3CCA2ACF71EBE4F37894
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6207.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4WcvlCO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447975
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++1tY4iXulpv5RX8/SflY:SbFuFyL8OAAx+4lpLRS
MD5:	E41112ABE6CC128CE3374D69A1F90CC3
SHA1:	D01AE20A14CA30C5EC623EA53D50CF48AE2EC04B
SHA-256:	D12D78CAFEC973139AD0A16252C006FEAB670D8857A685A7A49DF856232BDEDB
SHA-512:	BE35A0448C015BF3B727404917E4486CA73FF3B9B461C43B283D964C6296D22FC54AD0614FC7D6C7A168B198E0A83DC563C36CA351AD9C05DDBE7E650D19BC13
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6219.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5BizFzL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.974198609053518
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifY+iDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfYDjDJcjKR5
MD5:	3E56B13E04B967564790D4621DD5B63F
SHA1:	20F563BC2FE655C7DED06617A7320C84D50378E8
SHA-256:	840E9334B0649799B795B5DBAB8D6CDEED573907237B9948812E2EBCB174C8C0
SHA-512:	EC3FF64E4CA1C0F73D8FA397CF10EC79D64609BCDA2A7DFC64F2787118C6CE6BFE1C325E8053C8CCC839AB4B61DB6850DC4F47A22C5BA37A912243C2A4327BBF
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6524.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/journal/streams/.#9:66451QKUOYh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.510507467105052
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyqdHVURiQUQ6yWsjq:SbFuFyLVIg1BG+f+MyqdHVQQ4ji4s
MD5:	690CF8BEB2F0794D2D9A8B3B605BA8F2
SHA1:	5F818E25A8764CD78CB37A65695CAF35EBE239B3
SHA-256:	A78A9864AB870EF3102EB8698CE16C7B2D0931AF9123C3B01175C494D40B791F
SHA-512:	2D8EED6DB18881935D204C236BC449F7527A9B78D76451492D56078BC745F951CF81B39C2F38B8051A77FF2BAD54110F5313720C830687AF665103130B09D7F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80e8c221014c4482820d515098bf5601.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:66487bUFOng

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.448234147664733
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr2rSX8jRBbSYg2jsc:SbFuFyLVIg1BG+f+MqGsjRAN2josQu
MD5:	50292A2A5F1DB561CF04D06FA37FAA22
SHA1:	047140065EE330665A4C3B808CDA2862EEE3B234
SHA-256:	53925947CDBF6557FD412BA3197698C923FC5F1F02FD9972AB28D32D2874C6CB
SHA-512:	A866895600C0A456CBF326F274BCB38D439D6143E60009404AF9DBFBE7237C1529E3C4903B3D4981782564E5164516129AF8182F1E01C04A1103EE1C1745A44E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=adef667808434aa9b863c5794d721427.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:66490PTsbEg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.424444110165318
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmz8k33cqjs+XWI5a:SbFuFyLVK6g7/+BG+f+Mb33JjFmzXvn
MD5:	E620AF10B1728B0939CF5FB7F7F553DC
SHA1:	2784FC10E63D7AA3FCC1314863665394974CDD5A
SHA-256:	4328056EB8E991EBF46112404206554DED90C21A96AB1FCE0AF745AB90395FF6
SHA-512:	7AD4BCC993B02B39C4A54EEB95E2003CE028E5C96797EB24CEB616DEEEAE69B2F5A8455E70BD524F81CDBFB90A8D8436B41AEC4E5131F71487EEB0DA8E2B1923
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f85594ec46049c79c4f38de2f6e3694.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:66509YwOgCi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.36829943522702
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M47fScREjFmzXvn:qgFqdg7/+0+f+M47flOQXvn
MD5:	0874C089290BC002F1821ABB2E00F820
SHA1:	067C04683DEDC0ADE02A113470C2705AC20C0168
SHA-256:	8F367FC302C8B7A2E3F2010AC81879479B8BBF6E8B681CDEEFC4A44DC01EF99C
SHA-512:	7B09B10C236E9E26B0B42B03AF3FDD00DE87BF1C60ADAF63E0CBB496996C203BD6FFD6D63D45864146A44412750BE4AFE52DF457DD2AEACDBCFAC9D61DBCCD08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afef9d09e60b49f48ff7acadfbf734fb.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:66511sP1QUi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.324841724092587
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzNEDVXpVXG4+hTjsO:SbFuFyLVIg1BG+f+MW9TGthTjtWL0
MD5:	AE4BD2D031A7D322A1E37D511666C49F
SHA1:	01F09BE71E407975671AEFC154BFD2744223F4E9
SHA-256:	55E058CAAFE16856E065E6E7C97CDE5863B2F91825F0686C0ED3A48D00C13745
SHA-512:	B67180C033B5E66EA34F55F82FB529731BE9FF7D876CFCAA59741926A3A3C891E5F4B5600DE3B0608F107441264A6FE717B14482F4D69F9E6A174086C9903E79
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91fadaca8d064a0188d02c0f7c58949f.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:67993DnNdHh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.409819474426072
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuTQ6Rid9RXTTZF2ja:SbFuFyLVIg1BG+f+Mu9RidDT2jNE
MD5:	0B3AB5216A290D93EEBD5D8D824E7587
SHA1:	F34CD0BCBA96EF995A98934F64D234D1CF4E4EA7
SHA-256:	26071DC9FBAED4BA8EFF891A40C25ADECA7C72154C7335AF2AA250EE8FC3404D
SHA-512:	432E7B8166895449304A6DDE52238A539825DFD015C447E74D7F8D222418AE9D5136D1A5E2C2BD6365CA74BE920ED589D6E75B7F897BEC90BE6EDB37301CFB5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d41e872fab47464d8212c6a77a426624.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:680680IWLhi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.471009228796989
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+LMRV19sZjZcHcljX+:qgFq6g10+f+MtRV1OzmAu
MD5:	84AEE9B906C5726C7614FDAB42858115
SHA1:	912A67B60965FFC4FC6826C96A21BB850371DF4C
SHA-256:	3DEC8286E8D61B498D6386A62858BF1033B55AD322AB4571D60D34D106BD400F
SHA-512:	35605192026883864C33AA56BEE061E5B16F65910D70A4F3ADB374214A2E9CA97D1ADD214231542C9AFE41B43DCA82F1C8D62C1AB5EA9A071687E15824EE8C61
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=403ca7d638a649099bb93f864fe313e1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:680695wu5Re

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3620804505001285
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpPcIGEWxA81rxsjs1:SbFuFyLVIg1BG+f+MJc7V6krqjbVC
MD5:	E88907CF99FD20FB7D070F8FAC70C04A
SHA1:	3D3EF5D5D5EA45DABE91DEE05C10256DD4A17A54
SHA-256:	C1F7881ED0D2D20761F2CC6BA0E5AB6382FF9645F7F479139EE25211AB4D1F23
SHA-512:	CD624E9940C3A034C4FEA31ABA6907E379C4A8B3B7290F228667243BC04B633703830A00E809E3B8C564463CA5AB0D43792682C23E8DAA08EABB6E028B4A2C5E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5f5669badca43a5beca56f445d03c6c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:68078vJYT1e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.407256575247002
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzIl8ES1RTUaXUvs2C:SbFuFyLVIg1BG+f+M0yXzU0joa
MD5:	2D305DAB154979BD40021EF2C2414ADE
SHA1:	E8801414E706340DBEB44079BA9213D2CFBEA261
SHA-256:	45C520C45BB356AF8E07901DE81DD009AB644CD703BEFAB83462DA5DF29E8C58
SHA-512:	00652EF33B162FA398B59C103A820FBF7A6136CD8BCE87D794159767E8AD71171DD6112B9E5EF5F5E486B2B69846C4424C5397CADB5381A782504113B6064654
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9e934f55c4d5470bbefa19617802bbcf.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:68081Ye1J5g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.381242677077626
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsGXmGnI44KF4022jLkGq:qgFq6g10+f+MsGXO4ZVuT
MD5:	41A44294391475EF667420956F429ED9
SHA1:	5BE1344EC2D1CAC69474502421EC15ECB59FEA7F
SHA-256:	75461B41B1C8A5404C0821B9D7F470565066F576B6CF8F5FB5D3305E702A4BA7
SHA-512:	8AC913BD8E88A73A6AB587A603EF32E8BD5A69086CBF8823CD99DA010D27EFD5F7378C5C8F2BD97DD818C00C3507202F2DDEBC5C62DD1C9A979E68E2350195BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f53feea24ec64b20abcce312146c8b07.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:6808572KFZg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5203911537994985
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzQyGRUfFjHHq4+sjq:SbFuFyLVIg1BG+f+MERCjHHq4Tji4s
MD5:	7B41BCF679722BAC14B5F068843D6B03
SHA1:	108B649CC9030CEE5350AC53E81DE70CDA2C1DC0
SHA-256:	FB1666252B295547B23EAE6FCC6253F877F001F2E35250DE99C641F7D2AA159E
SHA-512:	7497FDBEB50880C61F415DA51010546AFAC2F14A5F14DA47EE90D74C1825394024CD57BA49302AFEF28300E203C46162648B45C33A6F9A979DC067AC257E6039
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=92e9fe07c4cf479ca02d8d510bc53ffb.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68086wp68Oi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.3767194911222385
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsTlRUyPZBVKe8js2ALl:SbFuFyLVIg1BAf+MsJz/se8jNALyAZD
MD5:	2048FADDFD0D19CECA8A741478A80489
SHA1:	6C0573847D76026FD0D9C8F0175F8C0C319E4FEB
SHA-256:	031B9525CD8077B3DAE0C2B5B68AF3284D328765D1B8020F96F2F3CF7277BE83
SHA-512:	9F74208D7931D665AF842EE9D179548BEF83C40A8C77D6797F8BDD9D98C98FD2B4C533AF5096691F431092B6E7E181F5A97D8D249372DA53BC0E018D76B3CCA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f316ea78f3a341b783aabcf608f016fe.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:682117RBtVh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.471447205197582
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm63T9gGrHTbmqTjs2BbM:SbFuFyLVIg1BAf+M63/TbmqTjNdQIeXD
MD5:	1305D8C53F918F39BEC067DC74B523CE
SHA1:	6C39DCB50EADCE8CBF196954408B39DDE2E1FEA1
SHA-256:	AD28A6704675364200A31BF74B1A294054925667154D2837A572851892AADF52
SHA-512:	D7A059F2560854383790F253A1B3A88B45863418700CCECB7F90D9AD4A1AA192F79C9B89AF71878E7FCC6CF0D93D92AA771DC8784EE3DA9DEA813ED1DE36EC6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=046df6b1ab0348ac980f671b662efa85.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69245QxUG3e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.40996112540412
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M80l+U3SjFmzXvn:qgFqo6g7/+0+f+M80iQXvn
MD5:	20E8F3818BA75954F7FBBBF3D3F4D847
SHA1:	9D13660638A84CFED71E83A02F8F2BCEF3A12AC1
SHA-256:	57D9A8D6BCE108AF6CD02D6B4AD0126CC7A55C9AFA84A005159CF78113E9F701
SHA-512:	747F5DD31997B93C4C85E3E808BA559CEDA695467E882125380EAF1E458FB8CBE3F9ED1B3909371D6DA8826D54799B71B6CA07B4C973D3F87F9C84267AB55D40
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ae8e9373c7a450e81ba987c2ece9cb9.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69247nIWVRi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.434524997716204
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuWHCoAAZjFmzXvn:qgFqdg7/+0+f+Mr+yQXvn
MD5:	4A31EE8AD1FC50EB41ABFE432240950F
SHA1:	9E37954192E26B459D2869392F6609FC6536508C
SHA-256:	A0152CC36A48C3FB9C58896A51306AA7DD193EB3583D07CC9F606BAD488D2419
SHA-512:	6510D82FD5504BA9F225DF09919488B2458EA5D606322AD2300E911AFDF154ABE37AAF499B5945912494DA8A8CCB8718A13B6DF4D14A04DA10D2261C84641C9F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1d840976be242fb98659a09a8ce270c.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69306G5xD3g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.451705650320935
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MubHRRK3KKv8jNq:qgFqo6g7/+0+f+MOuKKv+q
MD5:	CA73256A3632C389DDEDBB9CAB2983DB
SHA1:	2DAE62CE66A71246FB5709F3B80994938D4A9299
SHA-256:	84A2336977F92EC4CEF874CF2DA7B44090624EB95D4C3D1EA8F76A9763800BF4
SHA-512:	9EF45F0643593C2E8D07DAB87996679E27919EA57929939BEA4A35742EA9BF1CF6F8E8A581652933079A9D6A13E7B1D5F64B132FE408F51DA91A4A69ECAB3465
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d927dd63c4994765b3735fe9cbc891a0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:693081xF7ue

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.42897640157463
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm50+DQd1BGd8nCMp:SbFuFyLVI6g7/+BG+f+MW+DEBGyajNq
MD5:	99949EB363AEBC00E0D64D3C7AF7DFE6
SHA1:	66A213EF364BD50BF75D4C5A1B5A9454D0CD6390
SHA-256:	76DB74C1667B5086891178DD6DFB3671186B65BAFA717CF30252E09AD07B22D5
SHA-512:	A115BEDD8AB05EC85189EEFB428F2EBC5736A91474AC48FEC4B7F927C847E3DF2EADD5B57059AA43AAC7EAF945EF6A057C3294E3F1D18806B35245AC21729270
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3a813cf5d4854db281dc8ac62e71a702.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69357uLRoxg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.462645806162058
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MorORhjljFQMzKYA9:qgFqo6g7/+0+f+Mo83Tmt9
MD5:	35E2F1BCF43C12F2A0897F650A2478FA
SHA1:	7C47A77768A80685962BB1B4EF26BBB05929BA48
SHA-256:	D42783D0AA1CC5823746A0CAE78B2B15F2DBCA6B210FC9FA43B2CBFDE73F85CA
SHA-512:	9FBF804B37875380FA28A742ACF620127C848A716D3C0CFB68EC9A9BB6EE26A1B7C14FEFA186FDAF4CAFF1DAFA5AC5BA64D7402A1CDDFE808D8905123D16ED03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b1dcb1e0a7124bf9bf79ebf7db69d69f.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:69361H73Y7h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.496452653967155
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MjaRN2jFQMzKYA9:qgFqdg7/+0+f+M0NETmt9
MD5:	F075C2D6883AB6A421ED4C1BBCF6C188
SHA1:	12826A7240D312BDDE711ECA1F38DF05B85015D6
SHA-256:	20D5C6ACC898B21D2FCE9BDE0839780E524FDEC966C765E7A6900DC87EA5DFFD
SHA-512:	C45C94E29A0B3019FDE70F93D556B35576F473CBFD45E614C46FA3A47B54821220D4D2D60095CD8498448270CB6D6B90C03B08AC90BBECE165D1A3E4896287B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c045cacfa4d84160827e187f34decb22.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:69723nGLfmh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.367493198223235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/jU5dY5AjV9yF2js2BP:SbFuFyLVIg1BAf+MUuk9BjNTZD
MD5:	3F392F53627774CB0011DB0CD5E9A6A7
SHA1:	EBA785488590066C4C5E460C7FD4F1054E024B7D
SHA-256:	3A27EC15DB76E9D1D721F30DFAF7744BC31A2DADF27F8796C5A8E6BB465F9A35
SHA-512:	64A9546612AB788450EDE55BD8CCEAD0AC7AE78413C4096CAB997D63B3CB9FA108EEE822FEC51A98B2E15D22C87788FFAF9DDF5B16A27F62017ED7A4CF7C57D8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5fe74589114e428b8e98ae9eec0404ad.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69841WxgJMf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.411798452170632
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mo4NKa5NdjLTTIWTIL:qgFq6g10+f+MoTydEWEL
MD5:	9B47F1A8CEDA60BE75364D3614D81049
SHA1:	B4B64F7AF9AFE47C72085A367279C761B7F1B3DC
SHA-256:	C2FC23A3F06F45DCFEDE7D4944D53825CF4A8947CC10F327BEE791B6F1FACCEE
SHA-512:	BA397194F2EE28254D729795678A73F52E256C9782861C8CD69286E114FD1BB3774B6D5281E03397D4D08352B5D74EE264485626DAB48A89CCF485117AE984D4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2aba906607b43b1a6e928c18cab0742.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:700173BOAti

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.426344029359361
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzOGH6Jc6ciZdAgF:SbFuFyLVK6g7/+BG+f+MFmc6c2dATjNq
MD5:	18A0BE046D4E73BC3B21DED62421920E
SHA1:	A42BC9CE71DD7D5EAE77FF124D16E81B447DE32D
SHA-256:	A5DEF71050B44D3244D906A0A9A4A20B474103F7B63D72A9280D5BA6EB2DCD38
SHA-512:	1A3432D027D76EAA09965219C8E85D629F159B09F4B701B80582184EE0AD7AAFF72227BDCD69ADA2AD16697034AA08D4A60EBEBD96CC02837AD18301A2046A89
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=946acb49b8d649059f9bab3ff89e7515.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:700236Gbrzf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.435955839517963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4Gg9DcBh0LzO5qQ:SbFuFyLVI6g7/+BG+f+M4G0TjNq
MD5:	F2455AE75C76E845E4AE8FB678B17418
SHA1:	C8DDBA307F818EC36112E0BF5A1E8AFF567F3F21
SHA-256:	701D9FD2D93FC831F9B435A243ADBE32D7E6E5547C1D9CBA8BAE137E793E424B
SHA-512:	4C77AB89328B79F9ED56A04AAB385147D5E86DA3E9B9255CE0DE73651795E05CFD74ACDBE6FD13F3F6721BB931E4DB4A052F9235414FF0DEA405AEC1BF11FC4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c33cb8f9de24b28b05b123940757ddd.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:702289rO4Ig

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.548554920975048
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Me9MEhBn0jFQMzKaBu:qgFqo6g7/+0+f+MszT+Tmh
MD5:	BED0B64056A201F35FF1CE06878B0808
SHA1:	5FED66E9229E0B5B6E05F19C6490ACBAFC49FBE7
SHA-256:	191E4E1E63CE01162CACCD53910BC11050C31E9BD466381AD5D9BB3AF146F831
SHA-512:	F71062136D5F752A529087BCECF790ABF344541B4875AD24B0F8683A3DC8AD3514BB3C587E109817E544F1AC4C2F2C2AF6ECF806E23035966FDC29E044F18304
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=abff4b32f5914e9687b2f5c695360ed4.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:70229oCFE0g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.507217522970207
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MJCJEEm0jFQMzKaBu:qgFqdg7/+0+f+MJaTmh
MD5:	F0BF159D76FB6F9A6236536BE3FD631B
SHA1:	090DBC04D587E8C472FDE78AF2D2DA9B89275AEB
SHA-256:	54DD6CD3693E7305231B9610E640139130E736A82AA2D2621FC6853846B324A8
SHA-512:	AF8B12CAB818F5A04933D4A620445563B1C462FCA427AC24102709CF91D0658FF4625A9E9C7BD1F8B627DBB87FC21C7C1DF0248CB7BE89B679369E69DE85B305
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a7fd0e8efb34f0e80952b4428cab6d6.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:702351CupDe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.410500903564924
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/GVQfT7m8XVw3dPrm:SbFuFyLVIg1BG+f+Me6vmCwtOjoa
MD5:	DA8F2860A8EACEB6E306190F69F3E689
SHA1:	2F8BBFFEC3313FE3620DD13640A2A21377563F52
SHA-256:	BC8D4DE3671D679D26058B84D317BBD469F30BF84B4E5555052C63DF7958A9D3
SHA-512:	33104FDEE63C9A3646B2BD71C2FDAE82ED76674F0ECD7A4AA5BFC8AA37D8BB3B105893A99B6F9851C9F1902A0319B97B53FF08B0DAA98FD960F2C9C4CD474CB5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b70405723654792b9209d4fcd6e8358.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:70249aIhzkg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.356158926645652
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7F3GRDwUJY+sjsE:SbFuFyLVK6g7/+BG+f+MJ3Uwc0jN3r
MD5:	80BF96EB37BE6F8BF5E5731D0CD26747
SHA1:	6CBEA2205B0A178FF500BB7266FADFD5F3209685
SHA-256:	76B8B6B8E379B6C5F9BD06A3988EE8BBBF8BD46D01B9021602CB650DE8BB5667
SHA-512:	035AB2D5817B195F4CAA906F9EEEB2B05DF4CF01E344E526357D4848155F3A39CBE8D445E9617FAC6C4C75B8925A2FE5C4560EB26C6FA2F9BCD4F7BD14C20FA0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12e388026be146e7b494fe073db2e893.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:71889CpE0Ze

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.3723930401978865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7/1cAAMfBQZGsMy:SbFuFyLVK6g7/+BG+f+MheM5rqjN3r
MD5:	B3F6153CE75A6740488EE3AABC257602
SHA1:	B7123724FBAA005B5588E37AF7CA2A430A77247D
SHA-256:	13E76EDD458C9EACE69C0A87C9CD477841253F0549C42E4BE4E6CF0A9A6D577B
SHA-512:	564404694FCCABB7D2C920E32F6EA00BCD2D5AF00C15EBEDCFB2888925550F0E7B35A3BA4A116E996E9C18E984928E6A6A26FA24E69F6FB23DE4BFBA4F225D6F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a18f09c90bf4d1781e10ff3c52c704a.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:732673e5dRh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.422796139801513
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Me20KAdm5gIATjFmzXvn:qgFqo6g7/+0+f+Md0KAoqtQXvn
MD5:	7A33A71C2A5E5C3D6F606C8BC506ECAF
SHA1:	504D8AA015803EFACB8FDDB6C298E0AF6796AC57
SHA-256:	937A1430A5E9A684AFBFA980F2D676BC2F8E24DBE6054033723ED402972A0A0C
SHA-512:	4CDDC1FBB379AFF731D59A6AAD156F346E6B74A901E8AF508BF00C41E6495DDE924B285C0ED44C4795FB52E0136105F00A52CBCEAA77B85962AAD1282FA27F1B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4cbfe47c20b4b8fa6ce89c3ae29c5de.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:73271v3fPYi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.431169000005051
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8gTXwcywqjFmzXvn:qgFqdg7/+0+f+M88gcy7QXvn
MD5:	1DB7AE08CA6BD7977409A5E8A4E911AA
SHA1:	C4A9C66B4BBCE5FFEB5518DCC6CA335D9834BA9D
SHA-256:	5DB1DD6C11801F7FABE44373BF4797CDF754231977C6CDB52CF92CECD502E423
SHA-512:	959F1DD892613061EC68C2D5300A3F6B2058CE018E09CE9366D6AD3449BBD95C168B99D83EC5B3390438C880EBFCD7C939A5AE567991F30BB798433B704C09A5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6762bbf56e174cd792d767c444abc7f1.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:74435k9OsFi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.376164811814634
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6KDEZcnAUxWDvs2rQ:SbFuFyLVIg1BG+f+M6KD4cnxxQs2rqjt
MD5:	1CCE1D0A7601B5907020D8FFC95A52B6
SHA1:	F3739CAC4C41150F2D38D9557CAE0EF0A34B23A5
SHA-256:	2C7B07D4123FD3AE0EA79A18B004494CE352663A66E8F482A0D1485A656CE1D1
SHA-512:	FD49CA7ED8E1FBD148AA0C94B6282153443AD940CFD232DD95F10D991E617394D7CED67022AAFF9D9DB38AE1462758390F077C39A5D6335762F3F511F186048A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0458712b6a00467f930d1142cd94f225.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:74516NvXcBf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.426999131204321
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmumeDUSDThBVsjs2A/:SbFuFyLVIg1BG+f+MumlkGjNALQru+u
MD5:	9C769A1F01B00C11865193D925E6707C
SHA1:	B98A2D95B75640A3DAED212148DEEA1C403D4975
SHA-256:	2047B9A2938DCD978C21C1494FF818377B31EEE42C87E5A1304F61FC35C937E1
SHA-512:	459DC93619818C44C700D035528B0B36B0057C646DEA22D36479C974FD04700AE35C5E6B8475CB309670A13C6F02BF0F6BFCD7538C766B8D1910F1132EF2429F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3ef61df22124f4b8f1274f64e3f8570.IDENTIFIER=geoclue.UNIT=geoclue.service.

/run/systemd/journal/streams/.#9:74639dyC6Ph

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.39279060521693
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoOfbRPNm8jsmVa5+2:SbFuFyLVIg1BG+f+MoKbxjdcjemEg
MD5:	03560A726A7BEAAD3BBE0EEB3D59D660
SHA1:	57F2FAEA6276ACB0A4BAB6D524BB8F4263412DAA
SHA-256:	2CA659644B70F49CB04C7549C722FBA1767C04BCB970584398ED89E01FA888C9
SHA-512:	D01D1B59C93338735056B8ACAE6612954139EB73CD8424A5C2F4AF535645679706D73F3B17AE86FE47A8C2F67A5686338D43F68F73D9E329D3ED4DB20C5E6077
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b50df01ed2394cca8b77afd049110aed.IDENTIFIER=wpa_supplicant.UNIT=wpa_supplicant.service.

/run/systemd/journal/streams/.#9:74750ymZqzg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.402073143882526
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6r03T5phTjLIiAvAW:qgFq6g10+f+Ma09p+iAvAW
MD5:	030B820657C0A3C1F07DE4E300DD09BF
SHA1:	C771EC3EB767A79CAC5D1B96790CD8327FDC11D3
SHA-256:	AA0B223B56ABB68990EB41023FD07296841B0B445DC285A57D6B24B2680BCDEB
SHA-512:	7F651F0F44F2D0021BE63D6C63CF9747EFFB726BBC4E2FA7CEA09CC75897C6D3915CE389971390F759E57BE9166FAF4714AFCF05509019B4A9780A8CB85EB0D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0891bc55e55a42cd90dc7206e6c91d78.IDENTIFIER=avahi-daemon.UNIT=avahi-daemon.service.

/run/systemd/journal/streams/.#9:747944ZKuQh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.451429515798698
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MNoH+BQUjNuqjZcH5CHq:qgFq6g10+f+MKH+jxukmmq
MD5:	785A1A954792E8AFF33A85C72A91EF8F
SHA1:	35206EB434B12FB9BEF6D16E67F082A2D1E7B10E
SHA-256:	394D1D05B0F1CC1C222FD289DF04878473D2C5DBE428AA6714809BF49EFB4163
SHA-512:	6C5B0CDF4E3AF2D7B0B624A3C4105113679A7864C8B3B0997C5933D73C6D3C554205DF655C1387459FCCC025C3D2B5A8F998AA5BBD28452667373119D7C5737A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=919e86bf70d64eeaa5b4184d517f13c9.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:75006lhrwSg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4047872188033645
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpQ2cfMWESgTv8jske:SbFuFyLVIg1BG+f+M7AuFv8jfGt
MD5:	6F8712019FFF48E9957D98163D2CD55B
SHA1:	3981B9E7F12200BCE1D3F626C70FC51475874706
SHA-256:	275DCBBDE5CE8C659C085796DC34E16FB0F8EEC1B5303F19D8A7AD7D84489F41
SHA-512:	4D4C067C79B34B800D895C8F087BC9B34F442AC1A4218B6BC2C484F58057246F062FFBC27C46CEC582D3CA22F0B545FE73CD97F514BE84D681896B7EDCCFEE2F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c23bde988bba4b1a8c1c431c67be61f9.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:75820YSM84h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.426745990840533
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmudAbiQoIseQQy9SGH:SbFuFyLVIg1BG+f+Muyi2KfRqjuTt
MD5:	0041D3CA6FBF7DE6F5459C528051D167
SHA1:	F8B03C2FE9711A222EE93C3E5D265FE68546D6E4
SHA-256:	8330F78C4045B6765EC0582B79DA2D484AF4B1EF1A3898C60FDE2480ECD3A071
SHA-512:	F3EFAC5CD6EE653A5E5697A5E616F5D9F03694D72BB238E37DA633F3B80D5238E4B90322C2A6A831D81EEC37A9F6AF21E7F032A9D583C7F086244665FF784ECC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dfdc2399cb7547458364489557d8807a.IDENTIFIER=packagekitd.UNIT=packagekit.service.

/run/systemd/journal/streams/.#9:76204Y3siJi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.433047774837111
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M2dmnOjFmShmWc0vn:qgFqo6g7/+0+f+M2j9kWc0vn
MD5:	3C58600368760880AA2604CD00FA801C
SHA1:	FC5BCEDEF538940451E48993656D4F04B19D5D68
SHA-256:	2C072129B54AA911C66EBAA2E016158D2FF1971B5D2F40A84F2E4F946DBCA85B
SHA-512:	6B39135CBD7A35AAA9C52E3FF5385C8106A09AE3D91A91FC9E95C6AB68D5CCA19DC622F24315A9C2F0951996576B246FE651C92B6A2F703E1C8FCE367E142034
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=319d36807e7f447f8535813bfafe4cad.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:76209lTwEzh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.416040473124158
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+CpHJ8R0jFmShmWc0vn:qgFqdg7/+0+f+MDppt9kWc0vn
MD5:	722FE719DFD9B368D0E0A8CE630FC3B1
SHA1:	B7DF7013D15B80A6E4209CB99914E785032E825B
SHA-256:	DD84935186BA5AA50A3D309F87D07ACB8457632ECC7D60F40487487106C1E888
SHA-512:	D7AD640AB30900297EB5365CB214B42492EFAFCACA10252C15365E67116CE61E5C6E5FF204F06392B99E3E1CC533A057C46C9925A106B4A839A91FCF5D60DC08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=413631e4c38b4558bb15e7983de9a594.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:76213AZqo3f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.459903936506583
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+My+BAUAktqjFmShmVxfvn:qgFqo6g7/+0+f+MD2D9kVxfvn
MD5:	BB287EB28DA98439678DFB5271FA4914
SHA1:	1DB2C8F444B6FAB0C5A7A3047E16748166CA0FBF
SHA-256:	72DE836016F9B517C1B016DE5454894A6EBB3A71241DD62FF1A978089AF9902A
SHA-512:	56ED3B24ADAD5CE2E11413C9D5D672F0BC47A2258711103AF9FD1AC0C0B6293CB03EF30294D0FBDFA55DBCA578AA938CE31D7EA5F9B862A9A1AF220A122A1EC1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8024e2166c83439f9e158bd7c81756a3.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:76214oCaRZh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.398776015273708
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M80Ir0shuqjFmShmVxfvn:qgFqdg7/+0+f+M80MhN9kVxfvn
MD5:	5A6C093356EFD6409B2AC5680CBE2BA0
SHA1:	72D6EC65F6BBF9A021CBA09AF8DEC6BBEC85FED3
SHA-256:	C1DCFA1D28C23C79B260E2838F377902A4429617A124BE40468CB15F3AC400DA
SHA-512:	FB1C7E58F1C957F8CF945B2B188C396754D4B5060BB99F0EDC3622EE7074D6CF35DD0513383A5B670936FCE0C64CAA6EDBAF52DAA6697AAB4EB9BB6EC6248C22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65c6165af3f344f19b6c01bfaa533533.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:762230qBW7g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.438252671241217
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MscNvi9Yg2jFmShmDxfvn:qgFqo6g7/+0+f+MscNPgE9kDBvn
MD5:	7670862FE31533D4F8BE82ADCC4B0AF1
SHA1:	A97D8FCE33DBEFBE18CA503382F7997B0CF41060
SHA-256:	F45DBCBCA7303B1C23860EBB2E0DAA193FB6EBDF5D6A6808577545E0C6F8F8B2
SHA-512:	06E36B806EC8C2F203F03E6A839FDF31AAA12DCF5EF6354CEC8EAC3216D6699270DBD4D8369AD82FBB14A1FCA96C920DB5FEAF106750A7DA5425B20078D51872
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f995f615118d4af0985077a644b3458e.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:76224D20x3e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.405158220670034
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8JXZAXzt2jFmShmDxfvn:qgFqdg7/+0+f+M8sS9kDBvn
MD5:	953B000CF808AF4DC2FA8BAF3A4E344A
SHA1:	5939856AC456528A3CA29C84632B6B3B5997517A
SHA-256:	9D144A94B592B5F18A02BBC3AAC6718ABD7F61C3F368D572FBAB6DA28151CA9B
SHA-512:	8B46932AD7ABB9B87C649CDB3FEAE49109998B888627ED35D817466106D50FD4ADF70FB62514DCF84CEA8791013A167BFB6C3EA4445457D4EB4E73E3B9CC739D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ece3add0cbb435e9c74e80799d3b5fe.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:76243mVcdmi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.411627638394485
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoIXiX8Dsg2jFmShmxBrvn:qgFqo6g7/+0+f+MoUiXSK9kxBvn
MD5:	38A7DC4257F050482EAB3D171FF69574
SHA1:	2EC0777A316957CE836B96346B93704D6A4F5F32
SHA-256:	5DDBC992216DAE6AB0BE4139E222AA52BEDA981B2784E4A5D9629471575F504F
SHA-512:	3E9CB13E9490060EC41FA2856CACDD8B821748CB7688DDF52CF78C53899FD23A4848368478CBA45B6D10F4BCCBA34828BD15DC0A1855DFF53F95A8D53D84BF99
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e4520df043d942f69400020b7201ff48.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:76252iYry5f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.442594514065145
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuUEwm8m2jFmShmxBrvn:qgFqdg7/+0+f+MOwJf9kxBvn
MD5:	80162F03EE6F16DECED5FB247F61B7FA
SHA1:	5C5FEFBB2E78789E8F92C1B010C1A22FCDB38264
SHA-256:	22C54CE6ABF1CF228EFA7AB771643143613A75580D7956D5D9FD4D74C68410E8
SHA-512:	7F2266A97F0C2BE42FF45E25C4238F71C454D4B6C42BCE7AA7433E47D2C9441B9F9035FF670BA2E141C4A12D3C5B9C0D2133EFE4D4331860528341C3A79D6DBB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d17cb35185fa4cc2a1d11f1b16c53b4c.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:762578oGYvi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.3910730849878865
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4BQqjFmShm5PKJ0vn:qgFqo6g7/+0+f+M4BQ49kYJ0vn
MD5:	7BD7F9381AC50DD8638B583EFC5B607D
SHA1:	327B2BD50253C2E2E1FA20004DC4DF6BF2216E54
SHA-256:	66E2712764752EB20716F709E19F260F531617B40445C2235C50C1933676200E
SHA-512:	4648F880DD2474BB353B5DE0E6196C0B734547601AD70707103D636B99F20DD64DD7F3DD46D7C0D64F633F5FB56459D7FA9FD9155A45758ABDA712CF38F7268A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=237bba6ad3b44a40b5ba36d3f96bf2e9.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:76258W4Zncf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.396185072460972
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4HZ0EjTVjFmShm5PKJ0vn:qgFqdg7/+0+f+M4HZz/9kYJ0vn
MD5:	F5EDAEB21092299F7FC2B396A0C8D79E
SHA1:	1280E85414C55D6F6B37F57F563D106E9EF0EB1B
SHA-256:	CE76ADF226772F212FE0D8F356091A1693324E737B21481B9AB5C20CC15FE4E8
SHA-512:	27F9083F75FAFE7CDE3D6836ABA260A1950C1F0FFAFF3CAF055BCE4B5533D04B10B5B99431831847A0D7D908FC76B5649A1314F2A16B0FC0CD1941CF77C4436B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c897950a1024f8e92c79ecfb3ee7eff.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:762618v16Uh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.418985580736429
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mgc748jFmShmatvn:qgFqo6g7/+0+f+Mr799katvn
MD5:	EC77B135B7153093A03F4C92A8D66234
SHA1:	E6AB6C4E9DA781E98F5627D3640BE57B24EA5806
SHA-256:	66FE183AF010F34CADA145B77E2FBE8FE74C6AD1E678A06B49CC8FDC7FB5D3E2
SHA-512:	ED2F8EA978C23F31F53B367A2AAD3BB01F733AB5DC345AE5263309478E8EECAB2CFE980E359E07F8799C679745FBFE77D43EA95FF1D42F23C801165F37F02BA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa96b67400a54252a7120c7f399eae1e.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:76262yvSt0g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.419179302865903
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MjajR6GnSAjFmShmatvn:qgFqdg7/+0+f+M+jR6G19katvn
MD5:	6AA80E090348A62DD835787AA7FD24E8
SHA1:	0E9887CCF694B0C615C12F0F93DE1D28B9E422B9
SHA-256:	DA5379ABD73ABDE5096CEF0C2A5C42B10F11E1C6F4A81FADB8F0130F490C3942
SHA-512:	4990FA692088FAEED7900ABFEDD457203D6FE2564F1D62284A7D88404F2300A4F7E76A4E2C92428590FEC981C00801A3A814B36B5D78213CD5B1329DB79500C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac63e818f7e946ec8134c10c4dc71748.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:76266MUvj2i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.413261781106857
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+4SBr2jFmShmzxvvn:qgFqo6g7/+0+f+McrE9kztvn
MD5:	9D40133E41D725A91FD4135CA010E057
SHA1:	19302953B8EEA982E576262F5542B7B0585E0B35
SHA-256:	FC81D2D9999E406663FB98BB4988480F45CBE09716CFC4D4500697E72390A740
SHA-512:	7C3A8F603265B41657D1FB268ACFAA28EDF9614B0E2FB357F29F01B17096EDAAAD126708BD337932F31F0E92A08732339A5621F9778A640340EE4AE8ED66CA9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=40aeb183ad524b6bb2570c0c9a8abc8f.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:7626794Kk4e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.394415996898878
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MV4YXY30g2jFmShmzxvvn:qgFqdg7/+0+f+MGYQ0gE9kztvn
MD5:	AF398DE08EC43A278E43D153C06E4ED3
SHA1:	69B4B1926322C593AE1EE7DC40F1410F46AEB83D
SHA-256:	BB60DB303F58D46294B4B57BAB737EF8907167C8362D421DC5FE970B500C7BEE
SHA-512:	E1F833BF98621807743D88F8DA7A143E3F226563BA74EC86DBF893E8A101159EB4ACACFA2DCCF3BD531FB4D1195BCC82F9B34F9596D63E8EA9D65809C8F03222
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5fcdacfa53f9499e9ab3d61206ce5df6.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:76275Z4yYDh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.321463346435562
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+wJBqp2jFmShmZBvn:qgFqo6g7/+0+f+M/JBoE9kZBvn
MD5:	536F6C2F22DE09E17E92CE9574D0EBAB
SHA1:	141EA5B96E958CF3478E27213FC5CC37FD357A4C
SHA-256:	0102BFCB6D19520FC6BE351BBFD5BF53E8C10BA7DB73BC80BD7FD5780207C277
SHA-512:	9100E42D2926872F541BA5F9CA416642DDDD0D39EDFF1F3AE928DF927DB5C4E629243CB965AF802FDFD8C7393CE9B1AA9AE7C51CCD6467976C34E0B76B824CB2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ad746e62e9343a9a69577322d2d0ed0.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:76276K7pnYg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.392430009254497
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MpnDHczL8jFmShmZBvn:qgFqdg7/+0+f+MNce9kZBvn
MD5:	9495B1381173B7E80CEA9CC3F878D1EE
SHA1:	1FF788A6C89187BB0CD39CE5D3962F6AA886EB54
SHA-256:	9C0DF806D5421C5DA0D0EB028A65F54C2371F0A42315BB0B9A19B2267379506D
SHA-512:	012A60CB65776BDD5A698526A3BF1CF5A0A24E15743F3A3CEFCF0B6772CEA4A25A3508B6C610D141DF5EEA3898F6BBB53F63CD0C39EC3254C2F1D934D9971033
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e68bbba7bc50495d85f6b3e8cf409590.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:76302lCjRPf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.408500125060595
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8dKRZUUD22jFmShmwtvn:qgFqo6g7/+0+f+M8MRZVv9kwtvn
MD5:	E5001C195CE8C47A55480027A524C110
SHA1:	96B8A590C8C6AF708AB3BBB7FB77BBA3D4FFEAE7
SHA-256:	5828F21656BA6D4A01ACC731CE83A83B0F205DC157CC240FE66867B92E137379
SHA-512:	E1B3C70374D02D91D7981EDA246F929445A914CD0C2079D129B8E9927604B2847A540F3DCDE4BA21648D33AA1740EE15591DB54E0A61A84F556BF1168C5E0F8E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ee484aa980db4203afe2b19cfc4a8487.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:76321FBMpvg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.44520211306976
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M64dKFYg2jFmShmwtvn:qgFqdg7/+0+f+ME2N9kwtvn
MD5:	DF4E79C15119B586E6932559B6FF8144
SHA1:	6CA6E26080E850FB192498BC384B19250B80F310
SHA-256:	E56F273053F9E6A739BA6F2D5CA3376C52487CDE32B953BE6829ED48B85F7CC4
SHA-512:	7AEF1D272E37CFA25B765ACB400EF2ACF72AD58F9229CA8C117586C4F23176FF97F11AD54EF6E51CEA94D1319E5E27C0B0C24173BA0C3123653B8BADE956A1C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=552b6b83a5224ecd8b802de363714b4f.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:76326OzcF8h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.454284047401103
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuZTW4dFQhTjFmShmkiEovn:qgFqo6g7/+0+f+MGHYhN9kVEovn
MD5:	D8D3377D02BA979F1802F5593F37551C
SHA1:	A498D3F593BA61F14BF7590ADF652E0841FC82DA
SHA-256:	74F0337455B67D12192BCD4DF0D9F0FABEDDDBDDD20462CD109F413259B244F1
SHA-512:	E50AB914D3EBEFD57155F0D92F8DA76D6BAE2DCDE22AA77ACB02353B011F8A77893516C941BA05DC24BA38028FE7CC786A45D1D8F461AE88298EF1B81494275C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd4b2f6d8347483c870b762b3aff8206.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:76327DErSWi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.413054924499853
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoH0GAkOZEv8jFmShmkiEovn:qgFqdg7/+0+f+MoUbBZr9kVEovn
MD5:	6FD6C75C2A4F491EF29670C84EDFAAF5
SHA1:	2C04906514FE1BA39274090B2B462C0B0DDBCAC7
SHA-256:	94B33F5C01F438FCD5485660F43E0B7E3A71453765B5BEB0E673E35D6206F7D4
SHA-512:	49BC05D5FA734B481E3CCCE3A39C1C7ABA31107706AD26572065C0FBB278BA94725F24F9A99348E17608D66B7B7AF77E64FF390283A6BCAA06537FAEF908BA12
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bbb18238ba7a434aa21b1e1b5fa43221.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:76348rlgZ0g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.43126336961784
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+uB4cd8jFmShmpvn:qgFqo6g7/+0+f+MZ29kpvn
MD5:	93295E433E91A35E0FA06A4989DB46E4
SHA1:	0CC5A9FCFF6496D62F724A25F09C81A9888F2AE3
SHA-256:	C571DE6DCF8BF1CA56A72C366BB3F430B2B2ABB3FD9FE23F2C59D480EE339C83
SHA-512:	ABE020A1B802045D65C4D59777142B7D4A049FF4A70BF35E15661C8871E2D8FE4D6958DB9B9FE23F7B630A852326A37C18A482DACC0DF570FF754C9AA033FB78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=443f985d859c4292965ef9985cc3d1aa.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:76356yXxcyg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.398990783518399
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MkGkPkSZjFmShmpvn:qgFqdg7/+0+f+MkGkP99kpvn
MD5:	9FD412BF90183AFB322438B6568F79B9
SHA1:	4479DF79C7A4A78C6953F8FBF65F67713776906B
SHA-256:	8721936AA7D396D97D12251CDCC7453E763883287D01703284679494AABFA597
SHA-512:	BB958A9F6CA076D8A89247086FE620E72FA283D11627A6A2C75AD4C786B4A417B8029FDA9A2E0F410072CB783B237D3961E3CBE3220C724751FCDC0B10CC2774
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ea0074f045f143d482c1dc60e6a5f5f8.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:76379ixL9Ig

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.446516824895724
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MtlgTjFmShmQmc0vn:qgFqo6g7/+0+f+M7gN9kQmtvn
MD5:	718454A9D99E3C243B996E608C2D1806
SHA1:	8CBC6515E36C4C4C0E18B94C571294D55DF1DA49
SHA-256:	CB9DB8846AEE8A2154BF70638B2C796E0E5902326D8ED71F8BE3F926FE9765D4
SHA-512:	69AA8E231249910F010B61B75B7BB798839FD6FD24757A3EDC0411BBB2A3A84BAEA58BA76D8F48C322B4088D2695B699411E0210D3B020DEED9E437D46BA6244
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8216be1742346189253e4e452f71d02.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:76386SGCOgf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.459521072253626
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MSHBTGgQ8oTjFmShmQmc0vn:qgFqdg7/+0+f+MCBTBzu9kQmtvn
MD5:	160040F50350F5632123D3F3F0530499
SHA1:	C33096D5F38D46E876920D2BE443E424A1911B6B
SHA-256:	A64B354814A058F52ED6A15053B0434790B99734DE4A09625F3E20A436C6B1BE
SHA-512:	CFAF3DFA355645ABF97E31963CFA09CF4DA687CEF4B94EA266B2E7E5D465BE009795DE941CD9A3E2B1759825F73DDD0AD497BDFEAFE8731C23F72599B951BEBB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=98d7f99c830d4d68a6fd0295705b4032.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:763910myCGg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.431568001055679
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+9Pr/GjFmShmx+0vn:qgFqo6g7/+0+f+MOA9k40vn
MD5:	7402B2690EF4E622840BC70969A756E7
SHA1:	660B19D7D5108C4DBCC83EE9C6364DE5EBF1378C
SHA-256:	46C7AADF329FC0D6D25D630615DEA6F9114981FD3112676530747A8FC420B60F
SHA-512:	B627ECAE291F06717CF2D5AF08CBA33827A20E53B1C9D38BF74886DD586AB8C277ADD474C0E224509EDADEB0108C79BCB7124D6C6F7CD3443984DCD445A6D37C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a0e4fa9bf5c44e893ef4d8cebf171c8.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:76400hfEiji

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.437769173950426
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MP0/q2jFmShmx+0vn:qgFqdg7/+0+f+Mc/qE9k40vn
MD5:	910F6494E8DBA0D0DFCE8390199ADD39
SHA1:	2FB6E0980D1F119DCB792F9705F8D019BC70810D
SHA-256:	888397D62CCFCB5367DC83F5468A99A07355A4A98C94D4706728A7120DD42DC0
SHA-512:	834D69CE6F5B2F1F9C26A37FEBC7E59866E76EAFCA988FC06B652B1D992965F43910C162283C70B672E36637F189E9B8D72627C94853A51AD0F1FAF1B0647E3A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c0d07934ce8b4766bf3647d8987490bc.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:76425DlQo5f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.438567441143214
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6wFRK0WkZjFmShm3vn:qgFqo6g7/+0+f+MbRKxu9k3vn
MD5:	C51B63526E1364D72E9EBC170CD0D835
SHA1:	996224D5C32FB56AA97394D07981BDD0FC42F833
SHA-256:	25737E7C0C75C6A5447461D93798466D25F0E9641E843998C4D7BC79072C8CA2
SHA-512:	A1A15F8CDFB6618F4D90D29AAD1763FA203956687D52A6F7CAB8E04D128D771BD58CC533CF5C7C125252CDE3C0401CAFCE7CF4D2D575D9B2ECB6F4A908CB4AF9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=09d48797cc674167b3eb613857c99ceb.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:76447CKrNfg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.407331220283419
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MQdLRSWkW0jFmShm3vn:qgFqdg7/+0+f+MQe2+9k3vn
MD5:	F7D9A31AB698D51B45BED33CAEDBC21D
SHA1:	3B5EB56D89E42375B3C9377B41E5E23F210E02CA
SHA-256:	CCFE0B054C829B40A34526AA1DAA1B2D9381797DCD32AF4418F1110553183CCF
SHA-512:	635B7F5B6B4037A5A6F506678D3C7826236C3E5366322F247BC293A2499E270200E1F2C029614A9EA0F856EEE356E35455952B1AB8E2C8F8612BF3677DE11CFB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a7beab627d4d4f86b3473e71531ea732.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:765869yFYrg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.444991146390232
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoB5cx22jZcHdzqDq:qgFq6g10+f+MoB5cx2YmQDq
MD5:	82ABE18997D25E580C439E3911ABC152
SHA1:	FD4475D700A0D0D17794DD8CF33CE8B2450EDC75
SHA-256:	45001C84D76CAF293513D7F397F26118D0A76D2C8F90CF6CF7A78E1BD7E33D35
SHA-512:	32B77BB580A2B0055C69A88A2476203490BFA9B25191DD11149C389A39496B90EAABBC61CF68BBF152B59AA026CF0FD25470B3F60B6E7874189337F7EB41D834
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6bcf80f5acb4393a687c6a41cab6981.IDENTIFIER=systemd-hostnamed.UNIT=systemd-hostnamed.service.

/run/systemd/journal/streams/.#9:79153w17bth

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.343692046453201
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp8rBMRmUdtAB0js3h:SbFuFyLVIg1BG+f+MqrBqdtVjXjK
MD5:	BE986B370201B01983103BE684243C64
SHA1:	8980E0895D12F203D29FC0A4414384C41FD7B0B3
SHA-256:	6183E64083A2DF19911D3E6F28597EB01B6F239E57447EA7C6E67F8F4E8A695A
SHA-512:	26811126885726683AD80739BDD6EA78C74A8F83BF56A2F31A6E922314C37EC2F2EF168FA65698024CBB0205FEF4A4D5D28A958AA9457BD895242EE2B598E918
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c14d0dd887774bfda3664010e73561ed.IDENTIFIER=fprintd.UNIT=fprintd.service.

/run/systemd/journal/streams/.#9:791920BM2ug

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.400212981712672
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+gdGJQ1T7NqjsyKJ5:SbFuFyLVIg1BG+f+M+0MQdQjJKJMBNr+
MD5:	3811C826506875857C62CED34A5FFBEE
SHA1:	093C1B7B1426E9C3830DE70E60695351DC986659
SHA-256:	830BBC5AA680BA668A3A33483844EB1EA3262E27F096A5FE70318238C4AD3608
SHA-512:	62C1E592C86F7C4905E3389759F734D3A84209E6315067AFAD2E359A174A35E98A750BB01B067B416950DCBD8B59CA0F29ADD30E302927E440576C995AA60800
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=458829a9455c4cf0bb87e591684954f4.IDENTIFIER=colord.UNIT=colord.service.

/run/systemd/journal/streams/.#9:80092lZEpPf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.428725437203538
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MgBp+GQyz8jhD1DTu:qgFq6g10+f+MgBEH6W9Tu
MD5:	096D8476427D76B89D4D1810183B9AAE
SHA1:	ED2DCBFE7021CE0A216C1E95D8859381F893E1AA
SHA-256:	341D5178B4DA3D2AA0DCE6817E97F2C7680310AB43C116768B04E10DF43E3DB0
SHA-512:	359408B6B1944E3D84EE9E91A459C6D6814595FA0AA51F2240E45AF4F10C8108042C52F343372232FC5293836B101E6B154AE61117642A55845C6396670DFC13
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3784d22283234b1598fc5d0c4392becf.IDENTIFIER=ModemManager.UNIT=ModemManager.service.

/run/systemd/journal/streams/.#9:80119HbCaTh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.459676944981068
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MxRQhQcq2jZcH5CHq:qgFq6g10+f+Mx26Emmq
MD5:	72DBB0804D6690EBB06ED10FF8EAE68B
SHA1:	CE3B0D74639FD21A313D5E8EF5A8412B676018C6
SHA-256:	86F233EE3036A79BE1A4B67221DF7BB72AC72DF37C2C90800F6E273BADC7470E
SHA-512:	AD9368DEC156A0D2436C72349B25998FBF4691F2B88B4B37A82C2F890CC184135A4401BD070BE036FEDD340E31519D39FD39CE3B806F65C146A2E123965D5EE6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0077965245b4b8699d16769acbb9c68.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:80693bNM1Fe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.381661289874497
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5/m5RzLLY+sjsi8:SbFuFyLVK6g7/+BG+f+Mhm5RzEjZarvn
MD5:	08B147875ACBD523B03CC132AA4C2E31
SHA1:	6BCA072B496ED773BEE1AD892F8E64DA37D796E4
SHA-256:	777FFACE5B183F93026DC28EBF5D8CC02620EE443E68A6580271A98E3FB7609E
SHA-512:	55E46BDD752D3813BC1B90416CC537F983A6E3457B4D742FAC75E48F12193ADCC05A637DAD2B8715F9C7A6FDD5C356A70A5C0DF9DC5B402FE0B73CFD2AF6C642
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3d0fc1ec81e948a5bb6fbd76ad5e6e7b.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:80694mHQQCe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.403411322634379
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/YuDeQyQ1AnJqjG:SbFuFyLVI6g7/+BG+f+M/izJqjZarvn
MD5:	FA1C4B3ADB5583546183903AEAAFA8F4
SHA1:	7FFF351325749934E24547C38431F555D6F233D6
SHA-256:	A4CCD3F123C6620050CD95A3120B9F7F731E799F7ED14C19637E25A4EFBCAA48
SHA-512:	19D97E2CA8CC71AA6F0B92C7D2B34792180C9F6F70960A687A96946ED17AD3D35589A65441AC385D3526109F0A8CD212F906243E8926068B318A92488D9C6E08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b491be66c8b424fa562705668e98cce.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:807399SBKGg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.399235430953669
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmz+THNb67TH4cM02:SbFuFyLVK6g7/+BG+f+MiTQ7TH4cM0jq
MD5:	0D20D6EB2116E919C79DDD066E48E63B
SHA1:	912E4C5EFEEC3E3B86BD7F00BDAB7373895BDE53
SHA-256:	4E6B477459B83942C122B670403D9EFA17C1C8505931F9F29B212D576AEF4CC1
SHA-512:	F311A278D2FDD78D9EFFBC0AFEA4516BE435EBEB9D0E89A366369C2FA7D8AA7C7901A6CCBB7818AEBD03EF223E5DB7653F4DC1DD77E1E43A2F292AE3C471F85B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=913c6b5b908e4a2fb8c64831b6a13929.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:80741SY2Slg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.319637264954485
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrbETAHYSD2LRglL:SbFuFyLVI6g7/+BG+f+Ms4ARg2j022vn
MD5:	082FBDE93DEC962B9A134395FFBF421D
SHA1:	5D697EDAD1DB6F08B655238572BF737C07B25DDC
SHA-256:	0B0F1CBAF7349A047D7E7B11343B9D3D0EC56A4FCAAC0DA96D1C37B7D825F0DB
SHA-512:	4A4C7581A260C6622B6A2D28DA07B705D654685F5A3C43FA082E6DF9692772EB35FBD7FFF0B9A210B7206F57472C42ECD8434962FF29828058CE855F32766E50
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a62a6ebfa76d46219faaba77b2f7f082.IDENTIFIER=xbrlapi.desktop.

/run/systemd/seats/.#seat0FPtjKM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0ItxKjL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Ji53AO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Mw4u8L

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0py0yHL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0zav8UN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0zgWYLP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/sessions/.#c1CYfrYN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.368992734809206
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBiTgtWWFJ:qgFqPuFdDJIi9x2xayWAgtWoJ
MD5:	12C72858293671AC8777484D2C44CF61
SHA1:	2EE395A844E45EE8D3BDA730FDE699A75FAF31D6
SHA-256:	0ED1686CAEAEDDC5F52ED1FB73572CEC8D01FE5AD57B919C1DE6E7A7D7AC031C
SHA-512:	A97894308A554456C42694E0271B5F403056A4F6F315CE9B02CC8AB8AA40771557C8AD6B1E7B4C112DC073CB4D37FEF6D59B42A569A83653135137F88303E1CC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.

/run/systemd/sessions/.#c1DjNWUO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.412156211535245
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBiTgtWWFJ:qgFqPuFN6IG0n99x2xayWAgtWoJ
MD5:	FA322354F002C67C4791C9BF1F771FD0
SHA1:	6C36C32CC21CEF10278F97FAAD17510AC725783D
SHA-256:	21C6F5E4AC18B190E32D7E59641D2F9C1233E1DF5149C7F5F3ADED07BF72D665
SHA-512:	85CE146BD968B006FDD356EB2091561CC875FB49E6C354E8C9DE958B7CD845DD6F013790E5E28B3E6CE722B73CF07E06B69DF478BD55AA289363B062DA14DE49
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.

/run/systemd/sessions/.#c1QPLgSM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.412156211535245
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBiTgtWWFJ:qgFqPuFN6IG0n99x2xayWAgtWoJ
MD5:	FA322354F002C67C4791C9BF1F771FD0
SHA1:	6C36C32CC21CEF10278F97FAAD17510AC725783D
SHA-256:	21C6F5E4AC18B190E32D7E59641D2F9C1233E1DF5149C7F5F3ADED07BF72D665
SHA-512:	85CE146BD968B006FDD356EB2091561CC875FB49E6C354E8C9DE958B7CD845DD6F013790E5E28B3E6CE722B73CF07E06B69DF478BD55AA289363B062DA14DE49
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.

/run/systemd/sessions/.#c1WDvmRP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.422217411154205
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBiTgtWWFbX:qgFqPuFN6IG0n99x2xayWAgtWobX
MD5:	DEEF0D5506217FF6863E35B7084E4F00
SHA1:	8D81964F9E54B536B34F2F319975524AF8BF99AC
SHA-256:	375BA1B70A8A24E2DDB9B0EE1702865BC6817585C98942B3E1D211D271DE85AC
SHA-512:	B1C8F8738274BD488E8788D3661B07D5C54AE8688AF0B073268A9DFE830184CC86CE4C610017EE0CE62D0E6C6C601AE62CEF856939BAEA5CAA430B06F3FCEA76
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.CONTROLLER=:1.15.

/run/systemd/sessions/.#c1YdYQAL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.466789987382815
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffCVkxfx2xNIByy6GBiTgtWWFJ:qgFqPuFVuRZI4Bh9x2xayWAgtWoJ
MD5:	36A2CA40372A60022867C283ACA31362
SHA1:	49D616551547247C3133FEC2FE5A5A80A2AA13F3
SHA-256:	7CD82E5BCCAB82F7A53F90373CE1BA64B584A6C29F276ACBFDA1CCC5DE042A33
SHA-512:	B276FC77C61B0110FCF7E92B4B42A32262725806F2DB283143512600D28A2617AC7EACCE119885CA5B1E46E4A2F514D671E04C71BC9F9B1468410A9572EED410
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7882.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.

/run/systemd/sessions/.#c1q6QMnM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.412156211535245
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBiTgtWWFJ:qgFqPuFN6IG0n99x2xayWAgtWoJ
MD5:	FA322354F002C67C4791C9BF1F771FD0
SHA1:	6C36C32CC21CEF10278F97FAAD17510AC725783D
SHA-256:	21C6F5E4AC18B190E32D7E59641D2F9C1233E1DF5149C7F5F3ADED07BF72D665
SHA-512:	85CE146BD968B006FDD356EB2091561CC875FB49E6C354E8C9DE958B7CD845DD6F013790E5E28B3E6CE722B73CF07E06B69DF478BD55AA289363B062DA14DE49
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5718.REALTIME=1729683111482218.MONOTONIC=163052207.

/run/systemd/sessions/.#c27M6cbL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.434804164301875
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAU:qgFqPuFNuCH0nI9x2xayWN/TgtWVQO/
MD5:	7CBDDCB8D1B1989E408BE176CE8A07EB
SHA1:	B8D5D78E0033D300094B7CB4DC485AE9BD4DF96D
SHA-256:	34B8FD5ABBEC7FA24291BAE35B1D793B211950FF02ADA47A5DD68744967869AC
SHA-512:	B664A0C844F98492F7CB19B735DB1C8894A9E34C3D07D6FBF60C6AA3470B33D89A825C38F8BB366A807EEA02ADB07A697A6F3B92101DDC3D956F225C80D1610E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.

/run/systemd/sessions/.#c2AZhZRL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.494289177116936
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffXxfx2xNIByy6GBnN/TgtWeGQOAU:qgFqPuFVuRpCvBv9x2xayWN/TgtWVQO/
MD5:	77FBF1939191663C681A1D99A1F0FC0F
SHA1:	2FEAAEB0BB133B99CF1877D3B45639937FB728E2
SHA-256:	E3070E6D507676F9703905880041136FCC0804A0188991451871D96F23526B79
SHA-512:	15EA6664672A1BD3A60B77191A4B0D3857909AA92930DD05C534A0702A093954110E54DDB909C274810BB789FEAF40D4799050821BBD921D07AE08EF752BD741
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7945.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.

/run/systemd/sessions/.#c2POyTBN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.444153219226836
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOA0:qgFqPuFNuCH0nI9x2xayWN/TgtWVQOV
MD5:	0E782684C9B1100230A263C73AA4F451
SHA1:	CB7EC951E7C46FE052CD4262471F23B896C82851
SHA-256:	D977F514AEF6C228096E4B3631EB544A20984146443BC5B4C8F9D921C8AAC1C7
SHA-512:	AD5083FD7F2866EBC892087F1F8C41CA990D3AB4699E9A649AA369D9B71B7E6414B94593D32E3D166D378215D802A7A56508D306C7F0AEDB8638ACF328BAC6D8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2UHVQCO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.461723253516488
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAh3:qgFqPuFNuCH0nI9x2xayWN/TgtWVQOs3
MD5:	8BE7C113EC8AB5038CE8AC0A98272441
SHA1:	F692439E00E39F92E713DBB400D3E5ECEBAB918D
SHA-256:	071F5CE46E912DC7B3F25BCC02FA664D7A2C34D4EABB261CC0B9B947C00B0234
SHA-512:	24014ABE08F03209495311F991466FD659A25D82BD6E5E69F00AC05E3691BD44C8633D6FDD6FA80F2C42294138B9A007A553FE7040E5BA94F4304246F65867F9
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.CONTROLLER=:1.19.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2dgAnDL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.449727029729223
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAk:qgFqPuFNuCH0nI9x2xayWN/TgtWVQOX
MD5:	5026BD0296058A6862E97CD6B1AFC38A
SHA1:	77F0271C99A8CB74571343E97A2520677CBEB018
SHA-256:	540791FC4E162D7ECC61169E00635DFC93A9DBDD3D26BB5DCC50F6C34BD7611A
SHA-512:	BF8E75A872EBD961035C640AE80406D9D48E22DBB9193A5E86B90FB57A7A095C528A4B96B30A9BAA9136DFAB541628DF10DAE180317913FCCC9EF39990CCAE9C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2ewgpoP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.434804164301875
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAU:qgFqPuFNuCH0nI9x2xayWN/TgtWVQO/
MD5:	7CBDDCB8D1B1989E408BE176CE8A07EB
SHA1:	B8D5D78E0033D300094B7CB4DC485AE9BD4DF96D
SHA-256:	34B8FD5ABBEC7FA24291BAE35B1D793B211950FF02ADA47A5DD68744967869AC
SHA-512:	B664A0C844F98492F7CB19B735DB1C8894A9E34C3D07D6FBF60C6AA3470B33D89A825C38F8BB366A807EEA02ADB07A697A6F3B92101DDC3D956F225C80D1610E
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.

/run/systemd/sessions/.#c2iCUr8M

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.466855558301173
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAE3:qgFqPuFNuCH0nI9x2xayWN/TgtWVQOB3
MD5:	36A8EDA182A803F91F308738E6517218
SHA1:	8D86224D9A9F47940F733933F64B2F54BD678121
SHA-256:	D520D17425416CE5D022FA108156E8E02EB76B94048561C93B7246A5013580FB
SHA-512:	7CAFB20108B70CCA748C2D1193C35AA6E0712142BB77FDCB0FF7213F7FD74C93E7C0AAE16A8764670A675AA38F57AE85D2E600DB59FBA335E2F954D739CA9046
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.CONTROLLER=:1.19.DEVICES=13:67 13:65 13:64 .

/run/systemd/sessions/.#c2yoSCUN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.4680245607403775
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBnN/TgtWeGQOAEZ:qgFqPuFNuCH0nI9x2xayWN/TgtWVQOBZ
MD5:	F8B20CF6ACEA2F4D2E76423BB0261979
SHA1:	5A65595DF43297C5FF8B44D3DEAD4026D6690BB9
SHA-256:	D53C34AE9915B99BC10FEB807D4D061A2FF647C2C829F140124B68B0662666C6
SHA-512:	9F564425B4BFC47ECECF9BC13F4C7588777427867E70FD6215AC0B1177D71955D7BAF5CD730309FD978D453EAA2E6C774731E23DB3BE384AE4F2A96B134BB54C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5760.REALTIME=1729683123492408.MONOTONIC=175062397.CONTROLLER=:1.19.DEVICES=13:67 13:65 13:66 13:64 .

/run/systemd/users/.#1270pEM9N

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.163587666535703
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgtWHXqV9h2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegtW3qV9gthQHtPnmDqv
MD5:	A84204F9228D7F9E218E55BC1DAD16D0
SHA1:	2D6C9039607E77C32A6EAB14B71943964697F159
SHA-256:	611DD4FAE8BE88E5E2F575F079346B514D3738A550094962792ED98189940047
SHA-512:	A813377CD98C986CC5254B07FEF29085BEC817578F74D5BB52CD3620DD542C1EC932CF34B55AB61FF645A5B5F75ACD05DF21EFD7FB8D0743FDBD83302D37B5CC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#1271MaWjM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.178175845232715
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgtWHXqV9h2thQc2x9sS02nmD2owC:qgFq30dAL/ixegtW3qV9gthQHxbPnmDd
MD5:	10C196F7CEABEBF288C22BED94069FA9
SHA1:	889D74F7A4AAC4ED4ABAFC7AA62D3FB11C33B394
SHA-256:	1358C739702F435654F028A57E23E1211F3B5D4EB57635BA92EEBE8189C184D5
SHA-512:	3B567385ABCEF7DD9460F534028D3602F30B3DCBE1E5837FDEE116F502889056119721DE5185168CCC1771D9A1E1A5D2D94A345254E9C3F14F6DDFBEFABE9AEC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127Y1EkWL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.304519758699264
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFzgtWHXqV9h2thQc2x9sS02/g2owB:qgFq30VuR8L/ibB8gtW3qV9gthQHxbPF
MD5:	8E9F33B79BD0A5DB9A33EB778BADE177
SHA1:	C2B3D836BB044356B8D664B14B9D9A73AA4C24AE
SHA-256:	51BB9FB3273888EE661870A8114856FD08D1231A12FAA4DE3CC50C72B43C1ED4
SHA-512:	C2C753CA137FB0242FAF58A44DBA3BAD1B3A0D47EEC2AFEA84A03A306D00F9E40011F0FF2690DC655D22EB6CECBFF37644BDCB4A68DF0C991AF2E866FC44E3E4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127aAxFhO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.176915626294543
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgtWHXqV9h2thQc2x9sS02/g2owB:qgFq30z1cL/ixegtW3qV9gthQHxbPYA
MD5:	8AA06957D507C887FCE926853247062D
SHA1:	BAEAC572F490D8EA31F01D5BAD68BD49BF0519B9
SHA-256:	FFBA06EE86B4179C59DF195553DC15AFD374AA7C3FB1B4937B57A98696574332
SHA-512:	D754F24D0541BBD7DE318D4A01A64A755AADD7D3C8EE026E28F7042BB8134929A7A6C9069576F63D0C387A01339C0FE8F861B835883A19AF9C8AA89AFE296F83
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127cdKycL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.163587666535703
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgtWHXqV9h2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegtW3qV9gthQHtPnmDqv
MD5:	A84204F9228D7F9E218E55BC1DAD16D0
SHA1:	2D6C9039607E77C32A6EAB14B71943964697F159
SHA-256:	611DD4FAE8BE88E5E2F575F079346B514D3738A550094962792ED98189940047
SHA-512:	A813377CD98C986CC5254B07FEF29085BEC817578F74D5BB52CD3620DD542C1EC932CF34B55AB61FF645A5B5F75ACD05DF21EFD7FB8D0743FDBD83302D37B5CC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127exKcNM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.172186180048753
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgtWHXqV9h2z5c2zw02zb2owB:qgFq30NzL/ixxTgtW3qV9gz5HzwPzbA
MD5:	512504FFBC3D6D294440B5091BFBF048
SHA1:	1CA594BF66DAD827ED534F79F7FDAF5FBD03EC69
SHA-256:	264C1651E56311E6C4591829BD89408CE7058ACAC4BE151DEFF8D0759E041F24
SHA-512:	838935BFCE419AAA1FFB37840944DE04D2BE7DE5CA74A7B478DAD43B0FF4DEC33E497F0789DA4912BBB11E91AF11B2279C0172969414D6605D793396CDACEE94
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hwdDKN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.160979371314462
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgtWHXqV9h2thQc2x9sS02/g2owB:qgFq30NzL/ixegtW3qV9gthQHxbPYA
MD5:	0A0BAA89D459811B498CA102A9AA9F72
SHA1:	A4D8A3790D34E538B8D80AB67E918A9F2B182991
SHA-256:	9F1936D4D5D5CDC278457EC46FBB6FFAE78E7AF8C57C6094D4B59493F9F87030
SHA-512:	1D1E928F0DB88C071541648FF5F8EEFE20F8A66FA442C9C1BD4DD34B0E5879D6FD567CA65C2CA97067F9FBAFF6EE6D452A97ABA0F9103ACF99BFC992403B8B56
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127iIzdGO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.188122435028833
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgtWHXqV9h2z5c2zw02zb2owB:qgFq30z1cL/ixxTgtW3qV9gz5HzwPzbA
MD5:	D6A75709B18D2350592E4B96858E74C8
SHA1:	AE8BA75598457AAAB254BEE8D6688BFF46364BCB
SHA-256:	67B7D5B2508C6F822A2C21C71BE4E59F44C380A003C88CFCD59807EF2A163BCB
SHA-512:	D6BB8E62D299602A4E4EFF7BA9DE1D5B7F966144CBC1BDDC17FC34B5F40E0BA2D25E306E228DBBDFA39514686ACDE544A9750342401BA85E9EA48EDE6A215014
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127omnxsP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.323338620906825
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFySYfgtWHXqV9h2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBrSIgtW3qV9gthQHxB
MD5:	33D389E2B63A808E92DBE3F5BD48B897
SHA1:	8C69865CA6DC1C9C8444E92B04277D0F69F27DBF
SHA-256:	3E0F9C02A7C4E1C8DD295DDE3AEBE90403613F9E061FA22E0A83CCE5E6866099
SHA-512:	20B6C16D2641AE4A0BE5186949ACDD51017BE0539FA40EB5E718C9696DF7D388A82113F304C4A9BFE1662D8ED6CE82AA1F29B070CBB86DCC4C300F54A4A3AD8B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.DISPLAY=c1.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sI5WjP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.166585475591395
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgtWHXqV9h2z5c2zw02zb2owB:qgFq30z1cL/iRJgtW3qV9gz5HzwPzbA
MD5:	3FAA56B8A3ED2B526009F3FA7BFA2FFE
SHA1:	46251CD63C518DCB4B6D5AFDD9534213608D5EC7
SHA-256:	2108CF6B2A33A0A47B5B2E2E3DCE7E9391FA7C417FE9B7EFEE0FC10678114EEA
SHA-512:	A2CBD02FE9BCA168928B83DD575062B78E15C7C07A2722C7E461E75290C0951B834343430876C7B8A09211870513B5F72E0A467C69548BA5DCBD4BCE1AD2E50B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127u8nvkM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127yRcgIP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.301089742961843
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffCFzgtWHXqV9h2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB8gtW3qV9gthQHtPYb
MD5:	620BF5AAB235DA3C5CED3C17996CDA54
SHA1:	5B8BCEEC5BC3AD3FA7DBF6A3030E8B623116AEE0
SHA-256:	673EF7A13CE9E3B11DE3B2AD02365A91D22139FB1A8DEA708AAAF8E25A1AB669
SHA-512:	BC2DF2CE18E1C243EC94A4AA6060859FE39D4980B71CFD6AD3944F753EDCDBA9214995F8F938BF0A4E2607343877AC3E5EF868B90F8118FECD9C1FD2038001C7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7820.REALTIME=1729683111457489.MONOTONIC=163027478.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Fdjn:njn
MD5:	AD618E4001259EE94F30601E81696B2A
SHA1:	293BDA640FFF6E54DCED19591DDD9EE032CA2490
SHA-256:	9CA3AAB1C9C7CCE46CDCF61DC4194A767BEBB2C66EFEEFFE01D1688AB12713BA
SHA-512:	A3FD73F9411C7F6280590768AA37C4E2C8F4C49DEB881D7F67430C9055731D58F23779F7AD7B390D241A2873AFAB3F8D534CB9203CD28D26EE60D13F018B9D1B
Malicious:	false
Preview:	5586.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.010050656502384
Encrypted:	false
SSDEEP:	12:OxPXI3veY+XgtxPZGjveY+ZKNCcxPDQXwveY+D44xPUBKiveY+U3BQZ0veY+UXBV:xxAaXIr86BPav1k+1C9f
MD5:	5E893D7B1DE447757692E0BA131C4F4A
SHA1:	19167E464A4A4942917D5F33176922E079093188
SHA-256:	9636990F1A380CCA8FE9A6A448C07D74F0335676971488C3ACFAF2C73CC6EAB7
SHA-512:	D0E2C86ADCF7C503214A6873FBBC60CD14D36F0A7F907615A81CDC707C72E24D7824EFABE5EE1548E7F478A4D75D0298AA3856E84A40B2355E304E4DD4A89478
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5787..MIT-MAGIC-COOKIE-1...L.hy..W.d.....XSMP...#local/galassia:@/tmp/.ICE-unix/5787..MIT-MAGIC-COOKIE-1......@..h...i....ICE...!unix/galassia:/tmp/.ICE-unix/5730..MIT-MAGIC-COOKIE-1...z...t>^.V..gn...ICE...#local/galassia:@/tmp/.ICE-unix/5730..MIT-MAGIC-COOKIE-1......(:.~.M....S...XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.944833248737334
Encrypted:	false
SSDEEP:	3:rg/WFllasO930RKpcByENWFllasO930RKpcX:rg/WFl2tYNWFl2tC
MD5:	219EF02F0E318F96243A708C43EDE165
SHA1:	AFA0DDD2AA89280ED4933A90AB74207934DB706F
SHA-256:	3DD5677029AE7F0A8ACAD4ED5EDFAA5504481A214F0BB2DF203E2954FFB45746
SHA-512:	EA3ACC0129294EC34FA507A5AE222029C01FEBA608E191B2B230A799924097C12E52FC857F8F3CEE900E1FAAA409B631065AE9E77F944971324A9643D4143E7A
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..l. 4\q.....Zk.4....galassia....MIT-MAGIC-COOKIE-1..l. 4\q.....Zk.4

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Yv:Yv
MD5:	C7D7258BC585A98F6A96951E368B4689
SHA1:	13BDF0D0D2DA8CF43722E5E86A623808BAC21CD5
SHA-256:	A5D20063B20D88832EBF0AA523DEB8631C3606B35B04275A3C8188CBC1E009CB
SHA-512:	33EAF01C994E4A662732F8391EFF4E0BF83BE4724460B2DD002D036B27F4B6FEB20AE891DDF277297139B5025E537B54FD3ADA86A2D6E8D09CBEFFB1A272A989
Malicious:	false
Preview:	6052.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018081
Encrypted:	false
SSDEEP:	3:H0sXlXEWtl/Xscv4:1+yl0o4
MD5:	E2B44A0435272BB89FD487166649EB7F
SHA1:	C7CF07D9DC18E45B1F373C0B1B3356A1D50F79CC
SHA-256:	2B7D24D72D7113C2E3EAB4A2FBF79C3AC3E3571F51B11FA206EF173DEBC35A60
SHA-512:	1AC322B65BAD70E0A388A198CE6522343CB5815E4B5A8C9223F9C416B563B8588EC32E6920FCBFA512DF05089E2C3172B608D89CD20D3013CAB177E8232978CE
Malicious:	false
Preview:	....&...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................&......g.m......................................

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.AFE8V2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.R5AWV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.13910684373548
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWYs4UHDo19Q:q5sU3LWfLUDmQymqSFbfomS2s4UjofQ
MD5:	FCA723901A263BD6878158EA512813C6
SHA1:	35499BB4D07700D7064A86A0A961E2A9E0CE42B3
SHA-256:	73F0FDA50E2FE4E04F08F9C14FE8996A0A138E984A5DE6CE722C3A5F2BDBEA27
SHA-512:	F5DE7B7917B4A7E7B6A0DE13DD6C9A6179DB40B63BF22849CE949F6480EBB4C38EEBF15D319C08270457990B383FDFA369E500E7E8CA0FD3142D8139703567BA
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-nujtYXAr,guid=5339c8f60f15ed9bb085794b6718dedc.IBUS_DAEMON_PID=5943.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.28911276503935
Encrypted:	false
SSDEEP:	384:ramhYk5lfKMMJdxdLdCdtdkd+drdydbdKdqdcdAdqd8drdKdudwdWdrjdNWdqcdh:OmWsl9bI3cX0KHH46cGlC/ba
MD5:	54B4B15636F6D0DA817AED9B6142A860
SHA1:	D8A2962C9E571125757B27FBE327FB772DC7CBB1
SHA-256:	D3A5D5F33F99CCF4D3DBB3175012D4CD0D2EA38FB18C0E23F426C711FEFDA5D1
SHA-512:	DDDF9A33B44E004FD2217A2CDE87A99C098657EB1AA5F2274A2BA91751EA8EF7BF26F3672BD24CEDF037C62DBF4D8AD49B0222A1E897B82CAA66367469141343
Malicious:	false
Preview:	[ 176.417] (--) Log file renamed from "/var/log/Xorg.pid-5767.log" to "/var/log/Xorg.0.log".[ 176.434] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 176.444] Build Operating System: linux Ubuntu.[ 176.448] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 176.452] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 176.463] Build Date: 06 July 2021 10:17:51AM.[ 176.467] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 176.471] Current version of pixman: 0.38.4.[ 176.476] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 176.481] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2559
Entropy (8bit):	4.975197479556804
Encrypted:	false
SSDEEP:	48:1ATZK/jvlfVvVeh8rCqKvRigbOoTrboDrCn:+TZK/jvlf3gxRtb7T
MD5:	8D051487E113A43457A6C91FD89A7757
SHA1:	AED8114F83B72977CA69FE8349D2A92F03C2A286
SHA-256:	5CA1863EBB523F82C8850CB7BB450807739E3628450A72D6A371599FAC18E8B3
SHA-512:	95CF113CAE3CDAEA6E20250B3E9BA65B24C3252BA296FEB92D732BEC1025C56192C0C829E5D3C25A1985E1A06E5C403D5CBF7A284146E91AB288DFC73A26679D
Malicious:	false
Preview:	Oct 23 06:31:33 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Oct 23 06:31:34 galassia gdm-password]: pam_unix(gdm-password:session): session closed for user saturnino.Oct 23 06:31:35 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Oct 23 06:31:35 galassia systemd-logind[5602]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 23 06:31:35 galassia systemd-logind[5602]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 23 06:31:35 galassia systemd-logind[5602]: User enumeration failed: Invalid argument.Oct 23 06:31:35 galassia systemd-logind[5602]: User of session c2 not known..Oct 23 06:31:35 galassia systemd-logind[5602]: User of session 2 not known..Oct 23 06:31:35 galassia systemd-logind[5602]: Session enumeration failed: No such file or directory.Oct 23 06:31:35 galassia systemd-logind[5602]: Watching system buttons on /dev/input/

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.3921984062038995
Encrypted:	false
SSDEEP:	3:F31Hl+GLLzyWGLLzyX:F3uG//G/
MD5:	9ECB5164C233E1C5F8539FDDEACFEAF1
SHA1:	9C5FB563F640160AEF4D459101A8FDC4C076A956
SHA-256:	990E92D8A303F7ED9E07FA3A8FF3C64B4325321202636A99521907BD848BA8BD
SHA-512:	D1D9F6BFFC652CCB3156763161274DCA39656C1CF3512A102521D779DBD9D237200CE1ED20762377C9A702D0056BB95C8655EAA66FF1F045E772D95366DDEE97
Malicious:	false
Preview:	LPKSHHRH.................[2#.dD....N..s..................................[2#.dD....N..s.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlJgsJll/ngs5ll/:F3JJll/P5ll/
MD5:	6011233C7B5FB8445860241AFA0FFC49
SHA1:	199BD4DE1F716D48C34DEBB16B0CA4417B26A199
SHA-256:	8895DF1A6E5A239EE5190012AF94EC0ACD86BC861B9BD16D74DA013334BFC1DB
SHA-512:	6D3AE942C25C281519C49BE1EF58F6B8BF02E05D2BFE6E0AE517276E33351AB21F9FA5C7F7C5373B8C6B1B5D2CD2608688007D1E028F23E437D39575B973378E
Malicious:	false
Preview:	LPKSHHRH.................u.V..J.......S.................................u.V..J.......S........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	45137
Entropy (8bit):	4.7643594875388455
Encrypted:	false
SSDEEP:	384:vgrVnKfir7xT6IWP5QUHvIlgQCHnWvQey4p3PGoxMJVfwpG452:vgrVnKfir7kQUHvIllGVfHH
MD5:	0828FDE7ED3606B50E63BE504F681C0F
SHA1:	259F18895B317A0EAA43E983E745710D6937F1F4
SHA-256:	39E16C80E65A6BD630A08EE42DFF908FB45CE8700B7AD8D9B326B9DA5E82B3C6
SHA-512:	BBF47643E7B47EC6BC3A7EDCD62C646FFC1D2811BDBCA958B2DDF114E2694B0F7E0C564C976B0973CF830611EC67F2E82C3F98FB4C732199A5E4D539985A3D3C
Malicious:	false
Preview:	Oct 23 06:31:24 galassia kernel: [ 133.859470] blocking signal 9: 5534 -> 801.Oct 23 06:31:24 galassia kernel: [ 133.889572] blocking signal 9: 5540 -> 801.Oct 23 06:31:24 galassia kernel: [ 133.914523] blocking signal 9: 5534 -> 940.Oct 23 06:31:24 galassia kernel: [ 133.922573] blocking signal 9: 5540 -> 940.Oct 23 06:31:24 galassia kernel: [ 133.939547] blocking signal 9: 5534 -> 1289.Oct 23 06:31:24 galassia kernel: [ 133.943224] blocking signal 9: 5540 -> 1289.Oct 23 06:31:24 galassia kernel: [ 133.960968] blocking signal 9: 5534 -> 1299.Oct 23 06:31:24 galassia kernel: [ 133.961325] blocking signal 9: 5540 -> 1299.Oct 23 06:31:24 galassia kernel: [ 133.981970] blocking signal 9: 5540 -> 1300.Oct 23 06:31:24 galassia kernel: [ 133.983208] blocking signal 9: 5534 -> 1300.Oct 23 06:31:24 galassia kernel: [ 134.042440] blocking signal 9: 5540 -> 1364.Oct 23 06:31:24 galassia kernel: [ 134.063591] blocking signal 9: 5534 -> 1364.Oct 23 06:31:24 galassia kernel: [ 134.1018

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	164969
Entropy (8bit):	5.222561180192949
Encrypted:	false
SSDEEP:	768:ytZtxge/0uUldP4a6RlmAaSO/553r4PvY/jtL/grVnK6cfwGQhai7VQNoNtjXEZC:xac6bQ3SijFCQHT2bELEVfdd
MD5:	089D0710F70E9F218149D68FD85DC33B
SHA1:	5F03690C718CE3A624C27BC4B776853E0D0754BF
SHA-256:	F0E175A9426B6F1E63DE19361A29918ED2F47E44CD1336AD9E8D424C987A9F63
SHA-512:	D3E74437443932DF315F0288478F43CBF0BD41CA6CD23C5D5901E362B555ECCF7B4529E809B0396BC743545FA096E91E85C353F52E8985F9DD1201EC84B8FC79
Malicious:	false
Preview:	Oct 23 06:31:24 galassia kernel: [ 133.778741] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 23 06:31:24 galassia kernel: [ 133.778811] systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 23 06:31:24 galassia kernel: [ 133.859470] blocking signal 9: 5534 -> 801.Oct 23 06:31:24 galassia kernel: [ 133.889572] blocking signal 9: 5540 -> 801.Oct 23 06:31:24 galassia kernel: [ 133.914523] blocking signal 9: 5534 -> 940.Oct 23 06:31:24 galassia kernel: [ 133.922573] blocking signal 9: 5540 -> 940.Oct 23 06:31:24 galassia kernel: [ 133.939547] blocking signal 9: 5534 -> 1289.Oct 23 06:31:24 galassia kernel: [ 133.943224] blocking signal 9: 5540 -> 1289.Oct 23 06:31:24 galassia kernel: [ 133.960968] blocking signal 9: 5534 -> 1299.Oct 23 06:31:24 galassia kernel: [ 133.961325] blocking signal 9: 5540 -> 1299.Oct 23 06:31:24 galassia kernel: [ 133.981970] blocking signal 9: 5540 -> 1300.Oct 23 06:31:24 galassia kernel: [ 133.983208] block

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018081
Encrypted:	false
SSDEEP:	3:H0sXlXEWtl/Xscv4:1+yl0o4
MD5:	E2B44A0435272BB89FD487166649EB7F
SHA1:	C7CF07D9DC18E45B1F373C0B1B3356A1D50F79CC
SHA-256:	2B7D24D72D7113C2E3EAB4A2FBF79C3AC3E3571F51B11FA206EF173DEBC35A60
SHA-512:	1AC322B65BAD70E0A388A198CE6522343CB5815E4B5A8C9223F9C416B563B8588EC32E6920FCBFA512DF05089E2C3172B608D89CD20D3013CAB177E8232978CE
Malicious:	true
Preview:	....&...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................&......g.m......................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.114286476722213
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	byte.arm5.elf
File size:	81'380 bytes
MD5:	bef45203c68fc3734dd6fd1ad46f3c8b
SHA1:	d00655f9e6da4ea13e26c7b985df909146b35b4d
SHA256:	30d208417c8d64b0787de4a52e6f9c8c8433f4e8003089918705d73e1f8ee9ef
SHA512:	b68c5accd6d080045bfdfd5f7bfb7d74735ae563514ab53aa2fa92c1cade08b69b79047d94e9b7b0728d174895079aaeea525650b526d7258ba99bf414846319
SSDEEP:	1536:8ulphbwEBu0z41cNqftBQVWjtPBcby/oP+HoSl61d6L:8uDhD41twWpPywoWV4a
TLSH:	C6835C95BC815A12C6D162BBFB2E418C371653E8D2DF32139E256F51378B82F0E7B642
File Content Preview:	.ELF...a..........(.........4...T<......4. ...(.....................,+..,+...............0...0...0..................Q.td..................................-...L."...o@..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	80980
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x101f4	0x0	0x6	AX	16
.fini	PROGBITS	0x182a4	0x102a4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x182b8	0x102b8	0x2874	0x0	0x2	A	4
.ctors	PROGBITS	0x23000	0x13000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x23008	0x13008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x23014	0x13014	0xc00	0x0	0x3	WA	4
.bss	NOBITS	0x23c14	0x13c14	0x228c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x13c14	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x12b2c	0x12b2c	6.1979	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x13000	0x23000	0x23000	0xc14	0x2ea0	4.0506	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 13:31:22.175301075 CEST	192.168.2.14	8.8.8.8	0xa11d	Standard query (0)	asdffasdfasdfas.o-r.kr	A (IP address)	IN (0x0001)	false
Oct 23, 2024 13:31:23.115706921 CEST	192.168.2.14	8.8.8.8	0xe76	Standard query (0)	asdffasdfasdfas.o-r.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 13:31:22.182585001 CEST	8.8.8.8	192.168.2.14	0xa11d	No error (0)	asdffasdfasdfas.o-r.kr		154.216.18.116	A (IP address)	IN (0x0001)	false
Oct 23, 2024 13:31:23.123245955 CEST	8.8.8.8	192.168.2.14	0xe76	No error (0)	asdffasdfasdfas.o-r.kr		154.216.18.116	A (IP address)	IN (0x0001)	false

Start time (UTC):	11:31:20
Start date (UTC):	23/10/2024
Path:	/tmp/byte.arm5.elf
Arguments:	/tmp/byte.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	11:31:21
Start date (UTC):	23/10/2024
Path:	/tmp/byte.arm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	11:31:22
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:23
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:25
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:26
Start date (UTC):	23/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	11:31:31
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:27
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:28
Start date (UTC):	23/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	11:31:29
Start date (UTC):	23/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	11:31:30
Start date (UTC):	23/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	11:31:32
Start date (UTC):	23/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	11:31:33
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:34
Start date (UTC):	23/10/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5734/oom_score_adj

/proc/5737/oom_score_adj

/proc/5739/oom_score_adj

/proc/5741/oom_score_adj

/proc/5743/oom_score_adj

/proc/5745/oom_score_adj

/proc/5750/oom_score_adj

/proc/5800/oom_score_adj

/proc/5829/oom_score_adj

/proc/5832/oom_score_adj

/proc/5834/oom_score_adj

/proc/5836/oom_score_adj

/proc/5838/oom_score_adj

/proc/5840/oom_score_adj

/proc/5843/oom_score_adj

/proc/6006/oom_score_adj

/proc/6166/oom_score_adj

/proc/6176/oom_score_adj

/proc/6367/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#13dwZiL

/run/systemd/inhibit/.#2c4iWfO

/run/systemd/inhibit/.#3tPB5mP

/run/systemd/inhibit/.#4WcvlCO

/run/systemd/inhibit/.#5BizFzL

/run/systemd/journal/streams/.#9:66451QKUOYh

Linux Analysis Report
byte.arm5.elf

Start time (UTC):	11:31:36
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:46
Start date (UTC):	23/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:31:48
Start date (UTC):	23/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	11:31:49
Start date (UTC):	23/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	11:31:52
Start date (UTC):	23/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	11:31:53
Start date (UTC):	23/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	11:31:54
Start date (UTC):	23/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	11:31:55
Start date (UTC):	23/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	11:31:56
Start date (UTC):	23/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	11:31:57
Start date (UTC):	23/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb