Edit tour

Linux Analysis Report
sora.mpsl.elf

Overview

General Information

Sample name:	sora.mpsl.elf
Analysis ID:	1571728
MD5:	f38da917978d88855ecf8da376ddca08
SHA1:	80875703d185d63d9c50bb769f713792b36e0f12
SHA256:	636f2bb514e461c2914afa64f05550d18579e58d0404a2f914449068f9ed6f86
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "systemctl" command used for controlling the systemd system and service manager

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571728
Start date and time:	2024-12-09 16:57:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sora.mpsl.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/193@15/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: sora.mpsl.elf

Runtime Messages

Command:	/tmp/sora.mpsl.elf
PID:	6219
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	sp00ky scary skeletons
Standard Error:

Process Tree

system is lnxubuntu20

sora.mpsl.elf (PID: 6219, Parent: 6136, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/sora.mpsl.elf

sora.mpsl.elf New Fork (PID: 6221, Parent: 6219)

sora.mpsl.elf New Fork (PID: 6223, Parent: 6219)

sora.mpsl.elf New Fork (PID: 6224, Parent: 6219)

sora.mpsl.elf New Fork (PID: 6227, Parent: 6224)

sora.mpsl.elf New Fork (PID: 6229, Parent: 6224)

sora.mpsl.elf New Fork (PID: 6232, Parent: 6224)

systemd New Fork (PID: 6249, Parent: 1)

journalctl (PID: 6249, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6266, Parent: 1)

systemd-journald (PID: 6266, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6267, Parent: 1)

journalctl (PID: 6267, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6329, Parent: 1)

dbus-daemon (PID: 6329, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6330, Parent: 1860)

pulseaudio (PID: 6330, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6333, Parent: 1)

rtkit-daemon (PID: 6333, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6336, Parent: 1)

systemd-logind (PID: 6336, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6398, Parent: 1)

polkitd (PID: 6398, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6403, Parent: 1)

agetty (PID: 6403, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6404, Parent: 1320)

Default (PID: 6404, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6405, Parent: 1320)

Default (PID: 6405, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6407, Parent: 1320)

Default (PID: 6407, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6410, Parent: 1)

gpu-manager (PID: 6410, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6412, Parent: 6410)

sh (PID: 6412, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6412)

grep (PID: 6413, Parent: 6412, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6410)

sh (PID: 6418, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6410)

sh (PID: 6420, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6422, Parent: 6410)

sh (PID: 6422, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6424, Parent: 6422)

grep (PID: 6424, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6425, Parent: 6410)

sh (PID: 6425, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6427, Parent: 6410)

sh (PID: 6427, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6429, Parent: 6410)

sh (PID: 6429, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6430, Parent: 6429)

grep (PID: 6430, Parent: 6429, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6431, Parent: 6410)

sh (PID: 6431, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6411, Parent: 1)

rsyslogd (PID: 6411, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6433, Parent: 1)

generate-config (PID: 6433, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6434, Parent: 6433)

pkill (PID: 6434, Parent: 6433, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6435, Parent: 1)

gdm-wait-for-drm (PID: 6435, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6442, Parent: 1)

gdm3 (PID: 6442, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6446, Parent: 6442)

plymouth (PID: 6446, Parent: 6442, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6466, Parent: 6442)

gdm-session-worker (PID: 6466, Parent: 6442, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6470, Parent: 6466)

gdm-wayland-session (PID: 6470, Parent: 6466, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6472, Parent: 6470)

dbus-daemon (PID: 6472, Parent: 6470, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6474, Parent: 6472)

dbus-daemon New Fork (PID: 6475, Parent: 6474)

false (PID: 6475, Parent: 6474, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6476, Parent: 6470)

dbus-run-session (PID: 6476, Parent: 6470, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6477, Parent: 6476)

dbus-daemon (PID: 6477, Parent: 6476, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6478, Parent: 6442)

Default (PID: 6478, Parent: 6442, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6479, Parent: 6442)

Default (PID: 6479, Parent: 6442, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6448, Parent: 1)

accounts-daemon (PID: 6448, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6461, Parent: 6448)

language-validate (PID: 6461, Parent: 6448, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6462, Parent: 6461)

language-options (PID: 6462, Parent: 6461, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6463, Parent: 6462)

sh (PID: 6463, Parent: 6462, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6464, Parent: 6463)

locale (PID: 6464, Parent: 6463, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6465, Parent: 6463)

grep (PID: 6465, Parent: 6463, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6493, Parent: 2038)

fusermount (PID: 6493, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6516, Parent: 1)

journalctl (PID: 6516, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6517, Parent: 1)

systemd-journald (PID: 6517, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6523, Parent: 1)

dbus-daemon (PID: 6523, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6526, Parent: 1)

systemd-logind (PID: 6526, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6583, Parent: 1)

journalctl (PID: 6583, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6588, Parent: 1)

gpu-manager (PID: 6588, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6589, Parent: 6588)

sh (PID: 6589, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6590, Parent: 6589)

grep (PID: 6590, Parent: 6589, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6591, Parent: 6588)

sh (PID: 6591, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6592, Parent: 6591)

grep (PID: 6592, Parent: 6591, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6593, Parent: 6588)

sh (PID: 6593, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6593)

grep (PID: 6594, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6595, Parent: 6588)

sh (PID: 6595, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6597, Parent: 6588)

sh (PID: 6597, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6598, Parent: 6597)

grep (PID: 6598, Parent: 6597, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6599, Parent: 6588)

sh (PID: 6599, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6600, Parent: 6599)

grep (PID: 6600, Parent: 6599, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6601, Parent: 6588)

sh (PID: 6601, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6602, Parent: 6601)

grep (PID: 6602, Parent: 6601, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6603, Parent: 6588)

sh (PID: 6603, Parent: 6588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6604, Parent: 6603)

grep (PID: 6604, Parent: 6603, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6605, Parent: 1)

generate-config (PID: 6605, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6606, Parent: 6605)

pkill (PID: 6606, Parent: 6605, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6607, Parent: 1)

gdm-wait-for-drm (PID: 6607, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6608, Parent: 1)

agetty (PID: 6608, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6609, Parent: 1)

rsyslogd (PID: 6609, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6615, Parent: 1)

journalctl (PID: 6615, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6616, Parent: 1)

systemd-journald (PID: 6616, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6621, Parent: 1)

journalctl (PID: 6621, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6625, Parent: 1)

gdm3 (PID: 6625, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6628, Parent: 6625)

plymouth (PID: 6628, Parent: 6625, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6642, Parent: 6625)

gdm-session-worker (PID: 6642, Parent: 6625, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 6645, Parent: 6625)

Default (PID: 6645, Parent: 6625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6646, Parent: 6625)

Default (PID: 6646, Parent: 6625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6629, Parent: 1)

accounts-daemon (PID: 6629, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6633, Parent: 6629)

language-validate (PID: 6633, Parent: 6629, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6634, Parent: 6633)

language-options (PID: 6634, Parent: 6633, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6635, Parent: 6634)

sh (PID: 6635, Parent: 6634, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6636, Parent: 6635)

locale (PID: 6636, Parent: 6635, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6637, Parent: 6635)

grep (PID: 6637, Parent: 6635, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6638, Parent: 1)

polkitd (PID: 6638, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6649, Parent: 1)

dbus-daemon (PID: 6649, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6654, Parent: 1)

systemd-logind (PID: 6654, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6713, Parent: 1)

gpu-manager (PID: 6713, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6714, Parent: 6713)

sh (PID: 6714, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6715, Parent: 6714)

grep (PID: 6715, Parent: 6714, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6716, Parent: 6713)

sh (PID: 6716, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6717, Parent: 6716)

grep (PID: 6717, Parent: 6716, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6718, Parent: 6713)

sh (PID: 6718, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6719, Parent: 6718)

grep (PID: 6719, Parent: 6718, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6720, Parent: 6713)

sh (PID: 6720, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6721, Parent: 6720)

grep (PID: 6721, Parent: 6720, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6722, Parent: 6713)

sh (PID: 6722, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6723, Parent: 6722)

grep (PID: 6723, Parent: 6722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6724, Parent: 6713)

sh (PID: 6724, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6725, Parent: 6724)

grep (PID: 6725, Parent: 6724, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6726, Parent: 6713)

sh (PID: 6726, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6727, Parent: 6726)

grep (PID: 6727, Parent: 6726, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6728, Parent: 6713)

sh (PID: 6728, Parent: 6713, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6729, Parent: 6728)

grep (PID: 6729, Parent: 6728, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6730, Parent: 1)

agetty (PID: 6730, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6731, Parent: 1)

generate-config (PID: 6731, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6732, Parent: 6731)

pkill (PID: 6732, Parent: 6731, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6733, Parent: 1)

gdm-wait-for-drm (PID: 6733, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6734, Parent: 1)

rsyslogd (PID: 6734, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6740, Parent: 1)

journalctl (PID: 6740, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6741, Parent: 1)

systemd-journald (PID: 6741, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6746, Parent: 1)

dbus-daemon (PID: 6746, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6747, Parent: 1)

journalctl (PID: 6747, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6752, Parent: 1)

systemd-logind (PID: 6752, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6809, Parent: 1)

agetty (PID: 6809, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6812, Parent: 1)

rsyslogd (PID: 6812, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6816, Parent: 1)

journalctl (PID: 6816, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6817, Parent: 1)

systemd-journald (PID: 6817, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6818, Parent: 1)

journalctl (PID: 6818, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6819, Parent: 1)

gdm3 (PID: 6819, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6823, Parent: 6819)

plymouth (PID: 6823, Parent: 6819, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6839, Parent: 6819)

gdm-session-worker (PID: 6839, Parent: 6819, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6845, Parent: 6839)

gdm-wayland-session (PID: 6845, Parent: 6839, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6847, Parent: 6845)

dbus-daemon (PID: 6847, Parent: 6845, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6857, Parent: 6847)

dbus-daemon New Fork (PID: 6858, Parent: 6857)

false (PID: 6858, Parent: 6857, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6859, Parent: 6845)

dbus-run-session (PID: 6859, Parent: 6845, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

gdm3 New Fork (PID: 6860, Parent: 6819)

Default (PID: 6860, Parent: 6819, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6861, Parent: 6819)

Default (PID: 6861, Parent: 6819, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6824, Parent: 1)

accounts-daemon (PID: 6824, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6830, Parent: 6824)

language-validate (PID: 6830, Parent: 6824, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6831, Parent: 6830)

language-options (PID: 6831, Parent: 6830, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6832, Parent: 6831)

sh (PID: 6832, Parent: 6831, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6833, Parent: 6832)

locale (PID: 6833, Parent: 6832, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6834, Parent: 6832)

grep (PID: 6834, Parent: 6832, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6835, Parent: 1)

polkitd (PID: 6835, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6843, Parent: 1)

systemd (PID: 6843, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6848, Parent: 6843)

systemd New Fork (PID: 6849, Parent: 6848)

30-systemd-environment-d-generator (PID: 6849, Parent: 6848, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6935, Parent: 6843)

systemctl (PID: 6935, Parent: 6843, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6945, Parent: 6843)

pulseaudio (PID: 6945, Parent: 6843, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6862, Parent: 1)

dbus-daemon (PID: 6862, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6867, Parent: 1)

systemd-logind (PID: 6867, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6925, Parent: 1)

agetty (PID: 6925, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6929, Parent: 1)

rsyslogd (PID: 6929, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6930, Parent: 1)

gpu-manager (PID: 6930, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6934, Parent: 6930)

sh (PID: 6934, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6936, Parent: 6934)

grep (PID: 6936, Parent: 6934, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6938, Parent: 6930)

sh (PID: 6938, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6939, Parent: 6938)

grep (PID: 6939, Parent: 6938, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6940, Parent: 6930)

sh (PID: 6940, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6944, Parent: 6940)

grep (PID: 6944, Parent: 6940, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6946, Parent: 6930)

sh (PID: 6946, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6947, Parent: 6946)

grep (PID: 6947, Parent: 6946, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6948, Parent: 6930)

sh (PID: 6948, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6949, Parent: 6948)

grep (PID: 6949, Parent: 6948, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6950, Parent: 6930)

sh (PID: 6950, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6951, Parent: 6950)

grep (PID: 6951, Parent: 6950, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6952, Parent: 6930)

sh (PID: 6952, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6953, Parent: 6952)

grep (PID: 6953, Parent: 6952, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6954, Parent: 6930)

sh (PID: 6954, Parent: 6930, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6955, Parent: 6954)

grep (PID: 6955, Parent: 6954, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6937, Parent: 1)

journalctl (PID: 6937, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6941, Parent: 1)

systemd-journald (PID: 6941, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6956, Parent: 1)

generate-config (PID: 6956, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6957, Parent: 6956)

pkill (PID: 6957, Parent: 6956, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6961, Parent: 1)

systemd-logind (PID: 6961, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7019, Parent: 1)

dbus-daemon (PID: 7019, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7022, Parent: 1)

agetty (PID: 7022, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7025, Parent: 1)

gdm-wait-for-drm (PID: 7025, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7026, Parent: 1)

rsyslogd (PID: 7026, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7027, Parent: 1)

journalctl (PID: 7027, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7032, Parent: 1)

journalctl (PID: 7032, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 7033, Parent: 1)

systemd-journald (PID: 7033, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7035, Parent: 1860)

dbus-daemon (PID: 7035, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7038, Parent: 1)

journalctl (PID: 7038, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7044, Parent: 1)

gdm3 (PID: 7044, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7047, Parent: 7044)

plymouth (PID: 7047, Parent: 7044, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7061, Parent: 7044)

gdm-session-worker (PID: 7061, Parent: 7044, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 7131, Parent: 7044)

Default (PID: 7131, Parent: 7044, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7132, Parent: 7044)

Default (PID: 7132, Parent: 7044, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7048, Parent: 1)

accounts-daemon (PID: 7048, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7052, Parent: 7048)

language-validate (PID: 7052, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7053, Parent: 7052)

language-options (PID: 7053, Parent: 7052, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7054, Parent: 7053)

sh (PID: 7054, Parent: 7053, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7055, Parent: 7054)

locale (PID: 7055, Parent: 7054, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7056, Parent: 7054)

grep (PID: 7056, Parent: 7054, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7057, Parent: 1)

polkitd (PID: 7057, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7072, Parent: 1)

systemd-logind (PID: 7072, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7135, Parent: 1)

dbus-daemon (PID: 7135, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7136, Parent: 1)

agetty (PID: 7136, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7140, Parent: 1)

gpu-manager (PID: 7140, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7141, Parent: 7140)

sh (PID: 7141, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7142, Parent: 7141)

grep (PID: 7142, Parent: 7141, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7143, Parent: 7140)

sh (PID: 7143, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7144, Parent: 7143)

grep (PID: 7144, Parent: 7143, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7145, Parent: 7140)

sh (PID: 7145, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7146, Parent: 7145)

grep (PID: 7146, Parent: 7145, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7147, Parent: 7140)

sh (PID: 7147, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7148, Parent: 7147)

grep (PID: 7148, Parent: 7147, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7149, Parent: 7140)

sh (PID: 7149, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7150, Parent: 7149)

grep (PID: 7150, Parent: 7149, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7151, Parent: 7140)

sh (PID: 7151, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7152, Parent: 7151)

grep (PID: 7152, Parent: 7151, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7153, Parent: 7140)

sh (PID: 7153, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7154, Parent: 7153)

grep (PID: 7154, Parent: 7153, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7155, Parent: 7140)

sh (PID: 7155, Parent: 7140, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7156, Parent: 7155)

grep (PID: 7156, Parent: 7155, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7157, Parent: 1)

rsyslogd (PID: 7157, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7158, Parent: 1)

generate-config (PID: 7158, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7159, Parent: 7158)

pkill (PID: 7159, Parent: 7158, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7163, Parent: 1)

journalctl (PID: 7163, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 7164, Parent: 1)

systemd-journald (PID: 7164, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7165, Parent: 1)

gdm-wait-for-drm (PID: 7165, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7168, Parent: 1)

journalctl (PID: 7168, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7175, Parent: 1)

systemd-logind (PID: 7175, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7238, Parent: 1)

dbus-daemon (PID: 7238, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7242, Parent: 1)

systemd-logind (PID: 7242, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7303, Parent: 1)

rsyslogd (PID: 7303, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7307, Parent: 1)

gdm3 (PID: 7307, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sora.mpsl.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
sora.mpsl.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
sora.mpsl.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12580:$x1: POST /cdn-cgi/ 0x13a39:$x5: .mdebug.abi32 0x129a4:$s1: LCOGQGPTGP
sora.mpsl.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12580:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12580:$x1: POST /cdn-cgi/ 0x13a39:$x5: .mdebug.abi32 0x129a4:$s1: LCOGQGPTGP
6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12580:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12580:$x1: POST /cdn-cgi/ 0x13a39:$x5: .mdebug.abi32 0x129a4:$s1: LCOGQGPTGP
6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12580:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12580:$x1: POST /cdn-cgi/ 0x13a39:$x5: .mdebug.abi32 0x129a4:$s1: LCOGQGPTGP
6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12580:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x12580:$x1: POST /cdn-cgi/ 0x13a39:$x5: .mdebug.abi32 0x129a4:$s1: LCOGQGPTGP
6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x12580:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: sora.mpsl.elf PID: 6229	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: sora.mpsl.elf PID: 6232	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 13 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sora.mpsl.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: sora.mpsl.elf

ReversingLabs: Detection: 71%

Source: /usr/bin/pulseaudio (PID: 6330)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6434)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6606)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6732)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6957)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7159)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: global traffic

TCP traffic: 192.168.2.23:39088 -> 185.244.25.35:81

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6411)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6609)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6812)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6929)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7026)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7157)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7303)	Reads hosts file: /etc/hosts

Source: /tmp/sora.mpsl.elf (PID: 6221)	Socket: 0.0.0.0:23	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6221)	Socket: 0.0.0.0:0	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6221)	Socket: 0.0.0.0:80	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	Socket: 0.0.0.0:0	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	Socket: 0.0.0.0:80	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6442)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6472)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6625)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6817)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6819)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6847)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6843)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6941)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7033)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7044)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7164)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.25.35
Source: unknown	TCP traffic detected without corresponding DNS query: 64.42.101.152
Source: unknown	TCP traffic detected without corresponding DNS query: 42.219.86.144
Source: unknown	TCP traffic detected without corresponding DNS query: 112.102.109.122
Source: unknown	TCP traffic detected without corresponding DNS query: 83.191.119.154
Source: unknown	TCP traffic detected without corresponding DNS query: 17.140.170.251
Source: unknown	TCP traffic detected without corresponding DNS query: 77.56.82.20
Source: unknown	TCP traffic detected without corresponding DNS query: 204.114.190.98
Source: unknown	TCP traffic detected without corresponding DNS query: 40.84.114.207
Source: unknown	TCP traffic detected without corresponding DNS query: 133.162.130.26
Source: unknown	TCP traffic detected without corresponding DNS query: 83.174.85.165
Source: unknown	TCP traffic detected without corresponding DNS query: 69.58.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 73.176.179.235
Source: unknown	TCP traffic detected without corresponding DNS query: 154.115.68.143
Source: unknown	TCP traffic detected without corresponding DNS query: 244.147.30.88
Source: unknown	TCP traffic detected without corresponding DNS query: 71.138.21.205
Source: unknown	TCP traffic detected without corresponding DNS query: 62.249.77.142
Source: unknown	TCP traffic detected without corresponding DNS query: 212.121.179.52
Source: unknown	TCP traffic detected without corresponding DNS query: 221.186.35.213
Source: unknown	TCP traffic detected without corresponding DNS query: 80.101.232.215
Source: unknown	TCP traffic detected without corresponding DNS query: 170.196.62.199
Source: unknown	TCP traffic detected without corresponding DNS query: 104.85.164.22
Source: unknown	TCP traffic detected without corresponding DNS query: 193.78.250.248
Source: unknown	TCP traffic detected without corresponding DNS query: 2.9.64.109
Source: unknown	TCP traffic detected without corresponding DNS query: 37.169.22.213
Source: unknown	TCP traffic detected without corresponding DNS query: 65.244.164.83
Source: unknown	TCP traffic detected without corresponding DNS query: 152.49.109.200
Source: unknown	TCP traffic detected without corresponding DNS query: 183.254.108.36
Source: unknown	TCP traffic detected without corresponding DNS query: 97.135.131.62
Source: unknown	TCP traffic detected without corresponding DNS query: 88.30.193.142
Source: unknown	TCP traffic detected without corresponding DNS query: 191.167.27.157
Source: unknown	TCP traffic detected without corresponding DNS query: 16.96.129.192
Source: unknown	TCP traffic detected without corresponding DNS query: 87.138.125.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.51.33.228
Source: unknown	TCP traffic detected without corresponding DNS query: 145.106.169.115
Source: unknown	TCP traffic detected without corresponding DNS query: 123.2.96.212
Source: unknown	TCP traffic detected without corresponding DNS query: 193.197.13.20
Source: unknown	TCP traffic detected without corresponding DNS query: 183.138.174.105
Source: unknown	TCP traffic detected without corresponding DNS query: 95.249.105.142
Source: unknown	TCP traffic detected without corresponding DNS query: 75.167.21.9
Source: unknown	TCP traffic detected without corresponding DNS query: 130.234.20.60
Source: unknown	TCP traffic detected without corresponding DNS query: 70.39.207.167
Source: unknown	TCP traffic detected without corresponding DNS query: 35.17.244.117
Source: unknown	TCP traffic detected without corresponding DNS query: 39.157.237.196
Source: unknown	TCP traffic detected without corresponding DNS query: 91.83.238.53
Source: unknown	TCP traffic detected without corresponding DNS query: 126.112.178.29
Source: unknown	TCP traffic detected without corresponding DNS query: 150.212.218.60
Source: unknown	TCP traffic detected without corresponding DNS query: 72.203.107.138
Source: unknown	TCP traffic detected without corresponding DNS query: 34.71.94.119
Source: unknown	TCP traffic detected without corresponding DNS query: 120.123.172.150

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.48.dr, syslog.469.dr, syslog.495.dr, syslog.259.dr, syslog.275.dr, syslog.177.dr, syslog.391.dr, syslog.331.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53740
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: sora.mpsl.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: sora.mpsl.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/sora.mpsl.elf (PID: 6221)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6329, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6403, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6518, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6523, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6608, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6616, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6817, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6843, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6862, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6867, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6925, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6929, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6941, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6958, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6961, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7019, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7022, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7026, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7035, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7072, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7133, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7135, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7136, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7157, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/sora.mpsl.elf (PID: 6221)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6329, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6403, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6517, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6518, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6523, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6608, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6616, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6817, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6843, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6862, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6867, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6925, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6929, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6941, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6958, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 6961, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7019, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7022, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7026, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7035, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7072, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7133, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7135, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7136, result: successful	Jump to behavior
Source: /tmp/sora.mpsl.elf (PID: 6227)	SIGKILL sent: pid: 7157, result: successful	Jump to behavior

Source: sora.mpsl.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: sora.mpsl.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/193@15/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6329)	File: /proc/6329/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6472)	File: /proc/6472/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6477)	File: /proc/6477/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6493)	File: /proc/6493/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6523)	File: /proc/6523/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6649)	File: /proc/6649/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6746)	File: /proc/6746/mounts
Source: /usr/bin/dbus-daemon (PID: 6847)	File: /proc/6847/mounts
Source: /usr/bin/dbus-daemon (PID: 6862)	File: /proc/6862/mounts
Source: /usr/bin/dbus-daemon (PID: 7019)	File: /proc/7019/mounts
Source: /usr/bin/dbus-daemon (PID: 7035)	File: /proc/7035/mounts
Source: /usr/bin/dbus-daemon (PID: 7135)	File: /proc/7135/mounts
Source: /usr/bin/dbus-daemon (PID: 7238)	File: /proc/7238/mounts

Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:75419qMN4gZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:76087yMcnu1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:75684ti22jY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:757271ATQv0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:75728jjvMq1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:768992EkoX1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:76900FxEd01	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77027ApjL2Y	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77057riKsiY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77436ks7baZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77536J6OZm1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77636KS8YA2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:77976SARBH2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:78019z3NejZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:78119yYFvm2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:78122VTmpu0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:781672R6Ux2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	File: /run/systemd/journal/streams/.#9:78168GJmdYY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/seats/.#seat05XO5pi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/users/.#127tYy1Hh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/users/.#127F9tdAg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/seats/.#seat0K6kV8g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/users/.#127bWccPg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/users/.#127oornsj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6336)	File: /run/systemd/users/.#127HZkraj	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6398)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6470)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6448)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6448)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79938s9i9GY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79939QtgxAZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79940e5y8oY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79947U1oGsZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79957vk73pX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:793242CfFW0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	File: /run/systemd/journal/streams/.#9:79337SBwq4Z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6526)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6526)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6526)	File: /run/systemd/seats/.#seat0rKUgnD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79595UvhxCv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79596FPsJts	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79597UKHMer	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79598PNSJSt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79686VTAu3q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:79772EiRkVs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:80532w5yfgt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:80551gnz6lu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:80552lTMPsv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:81031FQvUOt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:81121F0rR4q	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:81245DjM4as	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:81439UD3b1s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	File: /run/systemd/journal/streams/.#9:81517GLWZiu	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6629)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6638)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	File: /run/systemd/seats/.#seat0WaCkjn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:80810jbMpSU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:80812zqqS0S	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:80813FTf14T	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:80814YnShiU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:80854pX9KKT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	File: /run/systemd/journal/streams/.#9:82985HZ8CEU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6752)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6752)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6752)	File: /run/systemd/seats/.#seat0Kay24K
Source: /lib/systemd/systemd-logind (PID: 6752)	File: /run/systemd/users/.#127I4sEoJ
Source: /lib/systemd/systemd-logind (PID: 6752)	File: /run/systemd/users/.#127nhSuYI
Source: /lib/systemd/systemd-logind (PID: 6752)	File: /run/systemd/seats/.#seat0wvpuMM
Source: /lib/systemd/systemd-logind (PID: 6752)	File: /run/systemd/users/.#127awdtJL
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:83336WL8OYE
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:83337DcjLxH
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:83342LTjw6F
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:833490mN2AF
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82179zLmZAH
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:821873T5F6D
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82211ZAUIiF
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82212R6HOIG
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82238Zp84mG
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:822400LqBXG
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:822424bFkME
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82263upJpUH
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:823183w0ppH
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:824185dHLZG
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:824216ZqlKG
Source: /lib/systemd/systemd-journald (PID: 6817)	File: /run/systemd/journal/streams/.#9:82580v1KIcE
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6845)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6824)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6824)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6835)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6843)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6849)	Directory: <invalid fd (4)>/.config
Source: /lib/systemd/systemd-logind (PID: 6867)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6867)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6867)	File: /run/systemd/seats/.#seat0zw7deu
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84761SggTR3
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:847645rnTg1
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84765eSDCo1
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84768wrDuZ0
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84771WE5OJ3
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:847809qRMA1
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84781aYopR4
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84785T3pMj1
Source: /lib/systemd/systemd-journald (PID: 6941)	File: /run/systemd/journal/streams/.#9:84790XZBik1
Source: /lib/systemd/systemd-logind (PID: 6961)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6961)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6961)	File: /run/systemd/seats/.#seat081RyeA
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:861420cYwzZ
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:86143IUASD0
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:86144Kxvgj2
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85029hIEk6Z
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85107bgeteZ
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:8511637TvnZ
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85136aAt2P0
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85160KZmJZZ
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85161wdRiM1
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85165n801m1
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:85264iBOuh2
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:86583hZK0I1
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:86597ytYULZ
Source: /lib/systemd/systemd-journald (PID: 7033)	File: /run/systemd/journal/streams/.#9:86715XMexM1
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7057)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 7072)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 7072)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 7072)	File: /run/systemd/seats/.#seat0RzbiMX
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85946IHEZBU
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85947j2oXyV
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85948KbmI0V
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85949a9mrAS
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85954XnFGaT
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:85964WLv6EW
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:88106YMG2aS
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:88196qQ1nIU
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:88329Bc4bOS
Source: /lib/systemd/systemd-journald (PID: 7164)	File: /run/systemd/journal/streams/.#9:88438kO9G9T
Source: /lib/systemd/systemd-logind (PID: 7175)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 7175)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 7175)	File: /run/systemd/seats/.#seat0jTuuxJ
Source: /lib/systemd/systemd-logind (PID: 7242)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 7242)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 7242)	File: /run/systemd/seats/.#seat0KG0NVP

Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7242/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7164/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7175/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7232/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7303/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/7236/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/environ
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sched
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/1860/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cgroup
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/status
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/comm
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cmdline
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/attr/current
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/sessionid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/loginuid
Source: /lib/systemd/systemd-journald (PID: 7164)	File opened: /proc/658/cgroup

Source: /usr/bin/gpu-manager (PID: 6412)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6429)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6463)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6589)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6591)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6597)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6599)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6601)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6603)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6635)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6714)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6716)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6718)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6720)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6722)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6724)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6726)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6728)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6832)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6934)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6938)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6940)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6946)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6948)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6950)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6952)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6954)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7054)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7141)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7143)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7145)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7147)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7149)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7151)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7153)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7155)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6465)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6590)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6592)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6598)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6600)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6602)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6604)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6637)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6715)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6717)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6719)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6721)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6723)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6725)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6727)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6729)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6834)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6936)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6939)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6944)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6947)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6949)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6951)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6953)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6955)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7056)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7142)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7144)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7146)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7148)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7150)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7152)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7154)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7156)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Source: /usr/share/gdm/generate-config (PID: 6434)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6606)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6732)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6957)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7159)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd (PID: 6935)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /lib/systemd/systemd-journald (PID: 6266)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6817)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6941)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7033)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7164)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6403)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6608)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6730)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6809)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6925)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7022)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7136)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6442)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6442)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6448)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6448)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6625)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6625)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6629)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6629)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6819)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6819)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6824)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6824)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7044)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7044)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7307)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7307)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)

Source: /usr/bin/gpu-manager (PID: 6410)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6588)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6609)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6609)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6713)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6734)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6734)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6812)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6812)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6929)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6930)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7026)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 7026)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 7140)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7157)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 7157)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7303)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6410)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6713)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6930)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7140)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pulseaudio (PID: 6330)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6434)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6606)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6732)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6957)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7159)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/sora.mpsl.elf (PID: 6219)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6266)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6330)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6403)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6466)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6517)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6608)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6609)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6616)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6713)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6741)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6809)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6812)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6817)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6839)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6925)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6929)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6930)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6941)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7022)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7026)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7033)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7061)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7136)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7140)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7157)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7164)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7303)	Queries kernel information via 'uname':

Source: sora.mpsl.elf, 6219.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6223.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6229.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6232.1.0000558887c21000.0000558887ca8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: sora.mpsl.elf, 6219.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6223.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6229.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6232.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/sora.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.mpsl.elf
Source: sora.mpsl.elf, 6219.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6223.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6229.1.0000558887c21000.0000558887ca8000.rw-.sdmp, sora.mpsl.elf, 6232.1.0000558887c21000.0000558887ca8000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: syslog.331.dr	Binary or memory string: Dec 9 10:00:19 galassia kernel: [ 563.429012] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: sora.mpsl.elf, 6219.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6223.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6229.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp, sora.mpsl.elf, 6232.1.00007ffd515e8000.00007ffd51609000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: syslog.331.dr	Binary or memory string: Dec 9 10:00:19 galassia kernel: [ 563.428990] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6448)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6629)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6824)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: sora.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sora.mpsl.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sora.mpsl.elf PID: 6232, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: sora.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 6232.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6219.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6223.1.00007f44a4400000.00007f44a4414000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sora.mpsl.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sora.mpsl.elf PID: 6232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sora.mpsl.elf	71%	ReversingLabs	Linux.Trojan.Mirai
sora.mpsl.elf	100%	Avira	LINUX/Mirai.bonb

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.469.dr, syslog.495.dr, syslog.259.dr, syslog.275.dr, syslog.177.dr, syslog.391.dr, syslog.331.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
175.183.249.0	unknown	Taiwan; Republic of China (ROC)	18049	TINP-TWTaiwanInfrastructureNetworkTechnologieTW	false
84.237.235.2	unknown	Latvia	44698	VPK-ASLV	false
192.183.101.76	unknown	United States	5650	FRONTIER-FRTRUS	false
187.230.68.107	unknown	Mexico	8151	UninetSAdeCVMX	false
119.52.34.220	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
160.49.201.210	unknown	Germany	2381	WISCNET1-ASUS	false
189.114.55.119	unknown	Brazil	10429	TELEFONICABRASILSABR	false
46.151.2.22	unknown	Russian Federation	197406	ASTELECOMLTDRU	false
189.198.92.196	unknown	Mexico	13999	MegaCableSAdeCVMX	false
9.240.98.27	unknown	United States	3356	LEVEL3US	false
106.146.73.117	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
111.241.46.78	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
31.243.255.132	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
67.203.3.42	unknown	United States	21769	AS-COLOAMUS	false
198.0.169.192	unknown	United States	7922	COMCAST-7922US	false
87.16.235.254	unknown	Italy	3269	ASN-IBSNAZIT	false
31.95.94.34	unknown	United Kingdom	12576	EELtdGB	false
150.224.222.41	unknown	United States	1479	DNIC-ASBLK-01478-01479US	false
158.125.211.186	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
242.243.223.138	unknown	Reserved	unknown	unknown	false
182.151.208.171	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
254.154.243.175	unknown	Reserved	unknown	unknown	false
156.12.105.235	unknown	United States	22192	SSHENETUS	false
13.101.153.99	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
203.78.145.229	unknown	Bangladesh	134749	SPEEDTECHONLINE-AS-APSPEEDTECHONLINEBD	false
119.113.149.105	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
38.208.120.38	unknown	United States	174	COGENT-174US	false
145.222.254.195	unknown	Netherlands	21286	KPN-CORPORATE-MARKETNL	false
183.177.8.89	unknown	Japan	17819	ASN-EQUINIX-APEquinixAsiaPacificSG	false
64.52.177.156	unknown	United States	26919	ASN-CBCBHUS	false
100.31.235.228	unknown	United States	14618	AMAZON-AESUS	false
65.5.21.22	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
37.168.253.19	unknown	France	51207	FREEMFR	false
140.223.47.185	unknown	United States	701	UUNETUS	false
220.59.178.161	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
32.201.23.240	unknown	United States	2686	ATGS-MMD-ASUS	false
73.70.15.13	unknown	United States	7922	COMCAST-7922US	false
185.41.19.237	unknown	Norway	199900	ASN-BEDSYSNO	false
70.159.74.2	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
106.194.113.117	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
186.196.61.111	unknown	Brazil	26615	TIMSABR	false
74.126.14.88	unknown	United States	12129	123NETUS	false
74.55.169.176	unknown	United States	36351	SOFTLAYERUS	false
65.222.204.42	unknown	United States	394096	CAPEREGIONALHEALTHSYSTEMUS	false
162.15.74.169	unknown	United States	46341	CPUC-AS-001US	false
244.184.48.74	unknown	Reserved	unknown	unknown	false
53.27.252.204	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
70.199.132.157	unknown	United States	6167	CELLCO-PARTUS	false
87.140.4.85	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
78.28.203.106	unknown	Latvia	5518	TELIALATVIJALV	false
165.69.212.49	unknown	Australia	7486	NEWS-INTERACTIVE-AS-APNewsInteractiveAustraliaAU	false
89.74.190.217	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
216.71.66.90	unknown	United States	39970	ASN-CELLU-4US	false
78.78.227.241	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
152.241.139.172	unknown	Brazil	26599	TELEFONICABRASILSABR	false
47.242.242.172	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
35.201.175.86	unknown	United States	15169	GOOGLEUS	false
5.51.28.47	unknown	France	5410	BOUYGTEL-ISPFR	false
78.62.90.191	unknown	Lithuania	8764	TELIA-LIETUVALT	false
108.72.46.207	unknown	United States	7018	ATT-INTERNET4US	false
135.25.74.4	unknown	United States	54614	CIKTELECOM-CABLECA	false
143.237.130.176	unknown	Sweden	199902	SE-LMSE	false
85.86.175.183	unknown	Spain	12338	EUSKALTELES	false
27.88.253.6	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
135.95.181.166	unknown	United States	29705	MOTIVE-COMMUNICATIONS-INCORPORATEDUS	false
213.80.184.148	unknown	Russian Federation	15974	VTT-ASISPSaratovRussiaRU	false
35.244.75.92	unknown	United States	15169	GOOGLEUS	false
110.49.166.9	unknown	Thailand	38444	SUPERBROADBANDNETWORK-AS-APSuperBroadbandNetworkTH	false
190.244.90.129	unknown	Argentina	10318	TelecomArgentinaSAAR	false
36.182.162.208	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
45.37.57.72	unknown	United States	11426	TWC-11426-CAROLINASUS	false
240.19.60.191	unknown	Reserved	unknown	unknown	false
4.185.159.165	unknown	United States	3356	LEVEL3US	false
199.43.111.122	unknown	Canada	15290	ALLST-15290CA	false
161.93.72.197	unknown	Japan	14298	EPA-NETUS	false
219.138.187.59	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
204.103.223.111	unknown	United States	2152	CSUNET-NWUS	false
218.121.35.176	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
217.66.211.254	unknown	Iran (ISLAMIC Republic Of)	24631	FANAPTELECOM-FCPIR	false
24.241.239.56	unknown	United States	20115	CHARTER-20115US	false
96.72.195.234	unknown	United States	7922	COMCAST-7922US	false
93.95.109.219	unknown	United Kingdom	5413	AS5413GB	false
194.70.131.155	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
167.106.119.63	unknown	United States	7183	SALLIEMAEUS	false
79.14.62.45	unknown	Italy	3269	ASN-IBSNAZIT	false
39.108.232.166	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
179.39.116.16	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
156.111.213.6	unknown	United States	395139	NYP-INTERNETUS	false
74.172.84.234	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
175.140.232.72	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
96.48.54.99	unknown	Canada	6327	SHAWCA	false
66.43.194.119	unknown	United States	5056	AUREON-5056US	false
120.166.88.126	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
110.2.226.2	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
255.46.203.122	unknown	Reserved	unknown	unknown	false
62.207.72.232	unknown	Netherlands	1136	KPNKPNNationalEU	false
84.232.30.19	unknown	Spain	29119	SERVIHOSTING-ASAireNetworksES	false
136.150.209.26	unknown	United States	1204	SUNYNET-ASN-ASUS	false
150.42.114.127	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
246.102.22.150	unknown	Reserved	unknown	unknown	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.203.3.42	bot.arm7	Get hash	malicious	Mirai	Browse
37.168.253.19	fU0e51cFa3	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TINP-TWTaiwanInfrastructureNetworkTechnologieTW	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	106.107.146.17
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	175.183.250.51
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	112.105.14.144
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	106.105.86.97
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	175.183.250.60
	arm7.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	175.183.14.53
	mips.elf	Get hash	malicious	Mirai	Browse	175.183.225.20
	mips.elf	Get hash	malicious	Mirai	Browse	175.183.249.2
	splarm5.elf	Get hash	malicious	Unknown	Browse	106.105.74.81
	ppc.elf	Get hash	malicious	Mirai	Browse	123.205.65.248
FRONTIER-FRTRUS	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	66.15.185.125
	Owari.ppc.elf	Get hash	malicious	Unknown	Browse	100.39.34.173
	Owari.arm7.elf	Get hash	malicious	Mirai	Browse	47.178.236.147
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	47.148.71.219
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	104.226.54.80
	jew.x86.elf	Get hash	malicious	Unknown	Browse	47.193.42.209
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	47.165.54.233
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	47.158.96.65
	sora.arm.elf	Get hash	malicious	Mirai	Browse	71.119.195.102
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	108.23.66.1
UninetSAdeCVMX	jew.arm.elf	Get hash	malicious	Unknown	Browse	187.130.196.206
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	189.228.105.208
	Private.txt.scr.exe	Get hash	malicious	Unknown	Browse	187.194.241.52
	Owari.sh4.elf	Get hash	malicious	Unknown	Browse	200.56.99.220
	Owari.arm7.elf	Get hash	malicious	Mirai	Browse	189.250.157.154
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	187.145.89.215
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	189.244.17.94
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	148.212.221.171
	sora.mips.elf	Get hash	malicious	Mirai	Browse	187.140.74.89
	sora.arm.elf	Get hash	malicious	Mirai	Browse	201.123.98.61

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6475/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6858/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mRJ:mf
MD5:	6C79FBCA98BE0F517E20EFEF0F6B0C1E
SHA1:	D54160F3B8F8B251C73F08D6D24A1E4158A0DD21
SHA-256:	69280E36735E39E2047611D7962EB80994EA7A50C7F856696AD7B84EBE049488
SHA-512:	4BFDA598D4C7B3D2AF773FF2F8351B04EFF824EF6E1F1086DAC2610B8779C6B629DFD660586CF5161F7D00E7FE60D73AC6337B33BCCE9CE8AF31B9BEB70CAA67
Malicious:	false
Preview:	7044.

/run/systemd/journal/streams/.#9:75419qMN4gZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.503016857565863
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6fcDBaTkdWEkCWWdR:SbFuFyLVIg1BG+f+M66BaoWfCr2ji4s
MD5:	6DDA34AB348146BC0F2A03C6A24B15ED
SHA1:	469D0F6D3D2A1A9AC76094373D26C43AE0AE49CA
SHA-256:	FC9EDBB25A0DC2D1602B729CE0208A6730A05BB063C78845DCF054D0F2179F2F
SHA-512:	317EF88761DB916D1ECB95EFD20BCACADC708E4659C723AE3AD8DDECCCEFE5EC2A7134DEDF7BAE1993BB9220558894C0CFE88F0D92376793E9AF40A099BCA36C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=01c9fd4f0dac4aba83a9052331688c0b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75684ti22jY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.40633537394721
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvGJS9SrAdRXXm2jst:SbFuFyLVIg1BG+f+ML9SUd9m2jdCLKzK
MD5:	63F88143E9B4A79F1C9DE9A2C9F12CA7
SHA1:	E685B04EC2EF1334DC7272EA633EA787D54BBCBC
SHA-256:	DDB527ED56B789C3376EB64A02396F02E67988FE68673D20CCE77F0F2CF84947
SHA-512:	9995771E27B8EF2EA7952EC0895214D4A2CAFFABCCC0929E64030ED09E06C267513C583825870FC570D32F9293696A752ED75089B98EA4A45E88AC283A4565C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed027597f5d34b9f82400be84a762588.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:757271ATQv0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.453284300116987
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuWRHOV0vchJkAYTjx:SbFuFyLVIg1BG+f+MuWRHZcTJ0josQu
MD5:	7A029AFDA035E744AD06D7CBD2E1109E
SHA1:	110569D512E0209AE8B2E6D905DBE0896429EED4
SHA-256:	8B6507BF84280807D2F503E3B7DE3BE99B312AD952AB0EF615B380BB9A75320B
SHA-512:	4E1A6C996AAE0708D3D7D2F4A7D79100708B89A02ECE5FA5E4CE012A90B111A8824DCABF2438815A33ACC47E85B197079F6630E12985063B33D77261387A5631
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d2c4b772610443f68140fc998e15e48e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75728jjvMq1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3876091127084385
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm40Dkyx6GCvcDMqjsO:SbFuFyLVIg1BG+f+M40wDGCUNjtWL0
MD5:	28EA4E209DC444C1D46DC0492E35C142
SHA1:	A5A1593184435F99BEC2F2DB69A47CBC0245B166
SHA-256:	43801C81BD8137A610CA9115013278235F4F53E4DF06C39AABE29A66E943A5B3
SHA-512:	360830FE3C3592488B7ED7C4589B7AA73145ABD33A487CEF7092B171503446991082A5508A23F331655E3D596640AEFB1B509B01169A89C54DBB8A30F5A392D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=27bfed7db4054c528ce314c53f0d6678.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76087yMcnu1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.514963603695595
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzeNV23js7LbgwzxYS:SbFuFyLVIg1BG+f+M8c3ji4s
MD5:	AFA8322BBDA216C40E16637D129DFAB3
SHA1:	AF7D5B7789128C2F312FF3EC0143B0467417A6A8
SHA-256:	EEFAACED4B869766D831531E0DAEA7E3558A18F70626E2767A161281BB9AEF20
SHA-512:	BD35B43B2681A299335AA952D5E0E1FD95A64AE4CDD0029F17FAAEC3A414DEF35F02CE3CF72188D3D0EE9A29BF912D7F7E575CE4D574002C80B219495193A732
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a321125de714081ac4f0194751c1b27.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:768992EkoX1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.39969037895068
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvLUBgOvsMxsjsjOdy:SbFuFyLVIg1BG+f+MIO7jNE
MD5:	9BC64AFF630CD62938095D29CB5634C2
SHA1:	BE402EBD53C73DF6182DDD270B2DCFF5B8F09383
SHA-256:	EE73032C90A89557D98D48FCE47AE237AFCED1DC464534E653B0D1B9B10D0C3C
SHA-512:	89040ACEDC2F17F3A34F9167DC5904792D6C642A86E5EB44BF84A7DC1F85379EC7787C13EA8A90EB634298904B8A7D6EB090B74515EE11E9E142CADD6D47461A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec912d9f92d743c08b431a2eedaa7702.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76900FxEd01

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.476668831059882
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5cAAWRDSDcNRcRXXo:SbFuFyLVIg1BG+f+MVN6djZcHcljX+
MD5:	211AF296443D1343405D4860BDC9F937
SHA1:	C536A5F9571B48496C72DD50F462D0B8E0CA2C48
SHA-256:	48BC884701DB81A94A98D8C4D646FD60182C74926C66FEB9068F1A8B6485D4C1
SHA-512:	8D253C4E3F0ED58B35B9E8F52CE48551FF70DB4940247708046E8BA1C178EDCCD481519DFD7D5C6E7CA415503DC3AB69D108E6471CCFB6A2805F340202726FD3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=31a6c61550e34f7f9a09494d51cef265.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77027ApjL2Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.426486638392177
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5Z4UvBXHx9aTjshKe:SbFuFyLVIg1BG+f+MHZvBXxwjbVC
MD5:	33F44DDC3060455436D35ED3461FAC30
SHA1:	2E62E31AF644D1D888A6112B9BAD67BD8324ACB4
SHA-256:	BB8704427024E24404A9A1AC9283C830EB48274A2B871F353628ABD32D86947C
SHA-512:	20FB113654EA38128A5EBC8F76FBE5804B32E18C1DEBAC37923E973504D2BBDCC21785545E16F80319DE7643249018A4FB2AD528773C550564C6B07491218F0A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38401ec190b544d2b388b1df75dcb065.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77057riKsiY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382612622378719
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GRd5BlRb1kInKCu/:SbFuFyLVIg1BG+f+M8UflpVK6jLkGq
MD5:	51011D17F2602E33A188FFD0D562E33E
SHA1:	F12443FC7B8165CF9202A24CD104ECEAD9BD1496
SHA-256:	D77B08374DFD56E066034D30884192274A2B96D648A80736EC87D0DDD9FEE97F
SHA-512:	ABE05E96CDB6EB09C4135FF589CF668F27E589AB8471D57C84FCD29705CE1F6BD7A0777CB2ADF4D29ECB006DD3C9525072A800756B2D14B8D53E340AA2DDBBC3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c5a8a67daa243999ba0d0d6a08b2164.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77436ks7baZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.414203105494947
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsosWmoKvshg2jNALyAZD:qgFq6g1af+MsoTKv+IZD
MD5:	10D366EF36F8A411BCF2F9FB731BF396
SHA1:	C7168A26FD3A81F86AA05A2162266AB6EB36D47F
SHA-256:	E989EDFDFC5A07343516EB589370F465C64455E0F5A274EF06778D78C9E19D76
SHA-512:	3247F8C139AA5884C3D63D932781739647444DDD318887B9BE0E7ACACE77579A6BC36D08D893258B313066C9665143DD54A11D120F25711D4F0DE378015D0529
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f31a0396956d4404a9c86a8400854ebc.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77536J6OZm1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.469521271754137
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mbcd7pjHRsNrqjNdQIeXD:qgFq6g1af+M4TK5w2D
MD5:	1C99986025660D103BAB9DE9F4B6C3DD
SHA1:	BF0299592E437B649BAFF3245184F895ADFE9013
SHA-256:	9E200F5BD379295714D403C80675E5D1E01D16D1174D9F2811D7DB1A8325669F
SHA-512:	6EFC5F3634E5D1D4DEFEDC9BC56CC05A4459E13AF985E0CAF03A572D36E1AB73C72CBB6483382C5673B38465B289E38574D9F1863705FF18186A3479246F5FBF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac504b2f98a74f71bf1b1f7c82d303f7.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77636KS8YA2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.392967990366643
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MojfKXUAzjdCt/rRMtq:qgFq6g10+f+MojfKX5CDL
MD5:	046CECC9E3AF0DCA647DA1EF8DF293EF
SHA1:	9759A953A408DA4294F31D564D4BE45D341E2D19
SHA-256:	0A44D0219861010F3A8E01CC5656817FB1AE1243AA140827E0540DB9DC4A14E9
SHA-512:	22072042BA745AE39A9CCCF87C74AF36EF19623C47E9DD2AE42B59639109C75783B59286134321E1A44E137D17631F899925610F68AF5F4EB00F9A4A84E089BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b304e29802ed4c8aba7c4ed84810ebd0.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77976SARBH2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.370960313478976
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmow5A6fDMYR0js2BZZGu:SbFuFyLVIg1BAf+Mow3MY6jNTZD
MD5:	A371458ABEDE26997EDB2D327493DBC5
SHA1:	257B5FD1ABE0259972ABD5BA36758FB90C681FCC
SHA-256:	F2A671399CD7822F1F820989B03616D28572A56869C6088EEECD86C9ADF2D26E
SHA-512:	DECAF40E530046B791AD677D8CF2A08B1A8FA7600D3DFB93A75EA5B17B4514B3E925E71D8CDC1312D4579886FB8E4FCC3A4C6D56284F167F6BFEC2DE9D7E278E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b4314aedaa20491a8f93ad6b4fd9b079.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78019z3NejZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.441599159087623
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My0ZR6E4ijLTTIWTIL:qgFq6g10+f+M8E4mEWEL
MD5:	82F133D4276E70AEB64CB845C8521A91
SHA1:	D3CC0DDFAD33573BE410A6A8C8A2E3EDD461C68F
SHA-256:	5354EF76CCAA2BD4523C722A0A60342CC3BCCF04FB83D0D94F1F6F6049F56757
SHA-512:	9E11ACDD426AB674E250B0E5FF63F0FEE12A98FA992FAA771EFA6456CBEA6BD606F2894EA6FE9541A4E6DC245637E8636ACF144CDCFAF8C2648D231B3BD5A049
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87b7951e883c41d6a6a821539e8045e2.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78119yYFvm2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3896055502753155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsCFDViTUQndmShs:SbFuFyLVK6g7/+BG+f+MsCMFmShg2jNq
MD5:	1719B40ABA38BE3C9044521069FD5B17
SHA1:	AC6872F1BE24DDB5F0F429E8F2750A738C4BDF68
SHA-256:	D9283E85CAE26A4B0ECBE6BA8270931B54FBC946476DA3C69DB0A80B5A9D465D
SHA-512:	3DFE4D54E732CED49A04654ADC442D31DB018E7506CADBD932CE46971B5D29C3596075AAE13C7FB3107D435B5E48AAF1B00BC586FF9AB10225AEBCA4D97DE0BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f528bf82bb5b46a3932bb80a8ba18d8d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78122VTmpu0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.408345183183326
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoTPtsQBKRqjNq:qgFqdg7/+0+f+MoTdBK+q
MD5:	C0F5286E2636FBC25D8428C3FBDCF16A
SHA1:	E1202CFD7A9FF42BDA232C1662240EF81CF47B6F
SHA-256:	18BD1037A3783342204949FEE385639E600365181538E1650CDAB51C9D8105B5
SHA-512:	8DD8E31610DEE619CBACE0CDC1B905088A62443D19A8E90FBFD2835D2183AB7EF29703E86DDBB401683D24298834A7BD6C68B14E679C5EB7CC9F851119D781CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b356efddeb1b4eaa82c3e808e674cd25.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:781672R6Ux2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.556219875615223
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MouANONEjFQMzKaBu:qgFqo6g7/+0+f+MouANONOTmh
MD5:	7D4CD290FD7AF2C6FFC81C4455ED3F93
SHA1:	42F82BDFED2984F078E67A8AA84103258C0A1907
SHA-256:	B7631C1CC162B481D4F22EB61A78B7E95D9D423BA3FA44955379C691712CA6D9
SHA-512:	A6E9DB85B9A8FA158F43E781519B2E83E2651EDA2A23D38BBB6C714E5E950DF952E2CFE30F347F11E5672C17428EE40CD2640D0409C3235E2130CD3D456515AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b862a5c13f944034b3ec832599e7f9e7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78168GJmdYY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.520149844326664
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MkPdIl8jFQMzKaBu:qgFqdg7/+0+f+MkP22Tmh
MD5:	D391BAC02D7D12C6EA289D06F0DD9767
SHA1:	77876E4F5325CFC710097F9126505FDA676332A7
SHA-256:	D04FCEF28FD17633B3C0D94EAE28B20621258DDABF4B6A23EBA9EEF24BA27BF4
SHA-512:	FF0EADA2777CA742C89CE1E9FFCEDCB05351327D0C668BAF0F6F56D595D20E2956CA67879471F784D0DC06C3605C4B668DC4DD7C0F996A3D722803E3409BC156
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a72890e2bc545a1800a98edfec6c7df.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:793242CfFW0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.465416855505248
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9EATW9QRguoWZjs2ALl:SbFuFyLVIg1BAf+M68CxWZjNALyAZD
MD5:	CE3C6F050C9975FD9A92ABBA2C88C4FD
SHA1:	7DC81FFBFBBA8825171A95BC4D1D8FDD6488203B
SHA-256:	D54434E4DB7027F24DD3590A51484C211D8DC0D2A0420F6DFC370F846D513CFA
SHA-512:	1237D4D63E1C57CB2B63970A5869B4E6BACE7D33BF236AF03C65B76FE5A82B1644AA85E5FFE0AD52781D9184FCCB84B00E6A714B4B1F2C593AD7575F5F758602
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=73fe6ac255bd431198954947b2ad1759.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79337SBwq4Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.45839086632477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+8kXBwGnVW0Rqjs2BbM:SbFuFyLVIg1BAf+M+LZ8PjNdQIeXD
MD5:	A0DF8D1CB3A262BB3EDDF60896F6E197
SHA1:	20F6D498F5773A49A89AD674488B60565A655EB5
SHA-256:	274C1C4100F3A5F96D376BC1F4B7297D2EBD454A75ED75B295E5BFED646A0F41
SHA-512:	54141975FA9FE72F9806C4E7AE5FCBE24DA26B648F77B9472AEB42AD6D7576B4209AD53DE3D6BE4AC5CFC99D24B066AC2DA07248C7FC1E7DEC8A2B0E34D6B221
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=418fa8eb72234c9384809c71034113ff.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79595UvhxCv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.517829117601649
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoiPVA7Dc8eUvRxsjq:SbFuFyLVIg1BG+f+MoiPV2DJeU5qji4s
MD5:	438478E37FC5527F1AD9A778884804F8
SHA1:	4258B23F70A26C8A206E83C90E97CFA5D81147DB
SHA-256:	CA5AC85F0A0DCF13A957F422575C03BDC2ADEC70BF1A42E1E5C33AB1ACE2D6B7
SHA-512:	6ACD537277DD5DE35911FE2B35FA91D0E36A77199955E74A68356591AB93392711F7455D7B5DFE430BB635050D9F681408BD4096D32E2026AF46212A47E100ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b4a624dd62c34003b338f449afb60541.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79596FPsJts

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382404094963137
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9s6VVkB/VT9Rf0jsV:SbFuFyLVIg1BG+f+MS6VVI//RcjLkGq
MD5:	1D0C2D2840B81EFFAFF78C94736373DD
SHA1:	4127AC57EFB9482D6E754E91DDD0938BFD1BCA55
SHA-256:	8D72AFB3C5815103FFE3D92C434ABCFDAC6E3778DF079A13333D2F7E59B92927
SHA-512:	AA177570F51EE57CBDCCBA06284AE362BD2E6743CAB5BF2B69815ADB787E011CB3B599E693431DC56D78B3C3F71A59F87949BB230FF921C2961E07094DA68A61
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=71e70501b7b349eda3067c60d24e7118.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79597UKHMer

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.40151067405466
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoBRA87JuhlZjdCLKzK:qgFq6g10+f+MoBRA4UhRCLAK
MD5:	E2DE5CE134964668106CC8D0D49A3696
SHA1:	443A4A199DE10974100E433C65E794CD8B8595C6
SHA-256:	29A3EED0923B31BF250B5365FC76547E4CC319AC77B8C1AC63C261CBC9265225
SHA-512:	36F887FDF2D208F0AC1C82E5438A3AB3973BDF410B17C76F87499CDF1689FF64D4751846AE415C3746679BBE37E9D257B28CDEB402458AAFA70742D3993C11EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bdd2bec4b79045929a195e08f576a715.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79598PNSJSt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.547381092784531
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+qaPCQwU1sjs7LbgS:SbFuFyLVIg1BG+f+M+zqji4s
MD5:	580D76F4B3C9B849929CDF14FD554B78
SHA1:	D0848DDC3C6194671424BA09B73D8D57683BD26D
SHA-256:	0D1A542785D5AE0DAFC902EDED6B12DD4D4F76F32AA96E8BBE87035442AE6347
SHA-512:	B1F758773406C7E8FE5411DBAA3EABDF91CD44FFC5987605FFB645B32263EC62744D291A371F981E7622A68580CEDCB3FE0A62B97C1339C2244DA9BE71176F76
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=47ec6716389c48da95259aebd6a3f720.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79686VTAu3q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.408487605058676
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/qRI0EGWmsMqjs2BZZD:SbFuFyLVIg1BAf+MSe0EG1qjNTZD
MD5:	E88CEB7BF8E8DC140BE499E82C483F4F
SHA1:	CFC281E7F6AEC7143EEDB976A59E6439A602E870
SHA-256:	C6C2DA4ABC56B651FDB0685E93649787EC84216657C84BCD03A274F434CDDE9C
SHA-512:	06B912E5882811699866EB2777B8D3E2D520E598C9B5F4617770D6D6CADD928F7F2FD63F4C8474A398B3C0739418C0D9FB5E4DAF69C9392B46343085DC78F1D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b4e7547bf76436d93ce9539bc3ae205.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79772EiRkVs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.445449397701467
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5X7ouUqGdJWA0Mqju:SbFuFyLVIg1BG+f+MOuKUMqjLTTIWTIL
MD5:	1DC9231A24D166368EF15FCF0868112A
SHA1:	66378B3CA1F83379AA58C3E879E8ADBA6550A8A9
SHA-256:	EC95997706A8578CDD5B5AA6543A6FFFFC18E36EE18F79D3016194B2C47E957E
SHA-512:	65B5A3AA443E78122CB308CAA8CD0950C5ED8702E34D7897F65587DF49326E27FB2457AF7D4DCF6C3F402861FA4A2C789F7D7E4D43970BDB657F9D27CFE429A6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32b2b17f1f22436fb5d0e235b872a53e.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:79938s9i9GY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.524339223046416
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzbErJyKgXzvs2lsjq:SbFuFyLVIg1BG+f+MXEr83j022ji4s
MD5:	BEFDECE12BA0F1B30A1844E7C51B0F2D
SHA1:	50EC763D077B1F8F27233FB21B5D5A19EABE07C1
SHA-256:	3380E0D987C409A015D3BBFEDE3C618E92B728A5D764F53D0CDEE22076822442
SHA-512:	5C4F96BEAB4B9FB32610F4F4512F4A489516C81FD0CE4A202DFE1FC8D5F07D9CF216191825661485CBABE0408EEC7425F9DB5F6D4CD30A1C8046E18C0E35210E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=94cefe58e5324c5c95941f7fe9e6b240.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79939QtgxAZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.404401415530829
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoDd78RA5cTHSTyXAz:SbFuFyLVIg1BG+f+MoDBreX60jdCLKzK
MD5:	89E4B517AF59205B07393A9826641458
SHA1:	D53B33BFAC5FE852F0CD9DD92583B8E04E58DD10
SHA-256:	0F898BBE60D874D65BAB4BB41F10CE2E7213ADA3064EFB26BF8D6538D8FC62E3
SHA-512:	B5E9D7104616245DBCFFF8E2839FAA5320DBDDC52CEC28E92CC91193EE6EB60923E108FB2BC33665FF8C90052A64B3962D7D4081BAD65162D89ABE6800C7D6DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bf53d0489ed74ee996b761ec4fce2568.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79940e5y8oY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.438292812346038
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzQkUFuxoYuxsjs1Ha:SbFuFyLVIg1BG+f+MtoYTjosQu
MD5:	7391EDC57ED9E772FADE4D2C0DD87262
SHA1:	40B0F3B43D4A3F8BAD313A87238E95C0D5788E9E
SHA-256:	5F7BA72C3E062C905280BFB773F6AF0EAF636EDCEE024E7D54225BFC80528198
SHA-512:	D45A0B7421D3671A7BF9B107572397C8F1F706F3BD17A7B7CDE47DE401C8497289693E33C45D364E770F5DCA7D3EB7CE232A8C4FC479D91E5CDFD40218016DED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b7f57a2a79940c3b01565120bff623b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79947U1oGsZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.475865906723903
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MRdBjNNRv8jZcHcljX+:qgFq6g10+f+MfnumAu
MD5:	62442AA93336A14BD1B9462DA5AB720D
SHA1:	47F09EB49C6287BAFE7AECD6F306746E82007AF9
SHA-256:	07BCB2E948F3D8F71ED138856E32418876069E933EC9AA348EEA920F7AF62683
SHA-512:	DF0A885B5C1A69F8BB7FA566B0E3C7C670E1B50746FC52B6A552CAA70073BC04537BE85413313709330A72CCFA54A867A434981DDC00F528610E9F0093FAD774
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e664a30d4a164f53b7ed6a829f7d4964.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79957vk73pX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.503016857565863
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoBGFdx/uIes22js77:SbFuFyLVIg1BG+f+Mowx/u5F2ji4s
MD5:	1683E9468591FFF4C949FC4283AE6A17
SHA1:	692634E2B08DB2E0C36D2218ED6AECF6374C75A1
SHA-256:	3977B3E745F38BC53272BADF634CA63CEC4B945FCD1E4E6516FF878AFE6050B8
SHA-512:	3701190C52EE9525C35CE8F86881C281CB2D6725E1112B59D3E6C52BD3FA19519D80CA8C7D33CE2B9279D78D8968093EF34DB1705FDA7F44D8710646D03E2F5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b24ca2f8a8b4473a80c20d5290cfad09.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80532w5yfgt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3701372774931855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr9H5eUv2tzWgEhB04:SbFuFyLVIg1BG+f+MR5LmhG0jbVC
MD5:	DB51B6C1AD92A143701E7C2AEA514B91
SHA1:	3D8CD8E7D9E5B2BC507C55542F2617828F5D57FE
SHA-256:	47B26E051BE840BFA53BE6CF3408D6CF1ADF215555F61DBDAC4F924C3B8D38D1
SHA-512:	074E0830DB09AB2C7C56D4BE031DC6B474CF84A7854AC639F0DBA0C13B404ED8FDBD83B4C48A53D3E3719A99FFDA2D9C0273DF8BB27AE74F5EEB1E59AE50F3D8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a02b5e60031643e49baf37e3bead92ed.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80551gnz6lu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.430000662806526
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsgogkDLAuo5FlsQ:SbFuFyLVK6g7/+BG+f+MsgIA15F2jNq
MD5:	59315CAE0C0B327A894648A2F5ED842B
SHA1:	A8814DFBA7F4DCC7EA66134761E310B5A7E6ED57
SHA-256:	D8DA7FB25FF136FEE3E458B852DA3668E1D42DC65C50F745D306F52064426CEE
SHA-512:	A112C719E1E511D5D00DC6AB8740307953E0BE008AD0D479AA0FF66C8ACA1032930E7D4F1D7066563055933D4C83CC0D5F8CF4AFFAA988BACAB1EBD7C37D82DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f765515e1f0144cbaf958ea27355ad4b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80552lTMPsv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.420589365557196
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrrREV3zQAvh+sjk:SbFuFyLVI6g7/+BG+f+Mah5TjNq
MD5:	7388B89B14C8C38DF4857890F3DD556D
SHA1:	00B2ABFB02CC79C674E99FD619A70F74F7375B46
SHA-256:	A3EC7835AFF430DE3CBCFD5F0235360F3B127321EC45B8D53204FB4C320C3B32
SHA-512:	417977C83EEBD7CC3B9FB03BE5A483AB25E6404C0EF96E42CFED79DB08BC3EC2658C91034CABB4CAC2BEEAFA27E1FE8C7C7EC4BE2E917CBCC0E6BCC123E44DE1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5941973b865408bac927f40045a7efa.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80810jbMpSU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.550202574771486
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4CNVHwBwViEUs2ls+:SbFuFyLVIg1BG+f+M4CHQWdji4s
MD5:	FF524F3789A96C5EF69D76CB0BC4F6E9
SHA1:	63308942EA384E1DFDEF6682F46B7EA1304CD608
SHA-256:	534214165BBF271177F0A9DDA09F1A428EAA75A1E91F9CEE0786890BA8CFB627
SHA-512:	088EC24B1F213691DA173899F69892E9AF125367792ECF2A2FCEDDA4356755AD9460C643E34896985A023F585024E88618FEF8EC094AE97C70ECD9D178670746
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=28e6d440b7fd43039c7016b895130b5a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80812zqqS0S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403310419701582
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvnCXnAvAbhvXsjsmM:SbFuFyLVIg1BG+f+Mygwh0jdCLKzK
MD5:	E4E3FF51825BF9E6BAE5BF946AB7D9A5
SHA1:	E5BF3C1B30C8C601EDC38C1C143293E3EE87EC2A
SHA-256:	DA42C61012702BFDFE702B4C7CDC2AD677C3EEF32C4ED3C8189F6C8D0F5A4193
SHA-512:	30EAB20427AE60C3E53385C3C6ECD259DA062CA8B6200B991E745C289C9072E6A26F78CAB662A6D48DCDA8057469C570B5A7B9DBB194B1084CF8837BEF366A99
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e87c2f4cb35d4502a85722362870fb4b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80813FTf14T

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421057080488693
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrWBdoRkEn+sjs1Ha7:SbFuFyLVIg1BG+f+MSBiTnTjosQu
MD5:	C6034FBE21F2758A509C022D07CB27DD
SHA1:	33EEA26CF220DC545869879685DD243C4C226E1B
SHA-256:	B06EC6E41382C92440A03B5F99ED1574F98855BE0B82E789A0933B69CD88F97C
SHA-512:	A8F18B2D264DE371A6497B2C5DAE2A4743924947FCCEC3F91CAF82CF567C4FBA3460EEE6D98B4B91D6D3F034212B51E4A315B37BBBF8DEEEC42DFC42D6343679
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa99d854d6614ca98610b1794dfab92c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80814YnShiU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.490807451462802
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8bNhcHWZrqjs7LbgS:SbFuFyLVIg1BG+f+M85O2Iji4s
MD5:	925C4C45CB4753226B1456F6D0A09D0E
SHA1:	3C597B44D4169048DED548050015210E230FBB81
SHA-256:	25EB5071C08F8FC4F25589029F5BE2BC0E6C9B977D1AE153582483B692020A5D
SHA-512:	C4F19A3DB1539A84079062673B7BFFBF74DA1D18EDC6BC13EAC03B2A42D67734370810D407C038730B0F2BC52D206F532343C831D1179073127A44EBE2F2DAB4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=66fec5e099bd4dc991ead4450565db36.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80854pX9KKT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.465086642847869
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M45V6xGuHO5jZcHcljX+:qgFq6g10+f+M45Qx2TmAu
MD5:	1E452ED27AD3520474B88ABB03A9B41A
SHA1:	FBAB508111977D9C6EE3014D09725A6350CED58A
SHA-256:	503E364CC0B7E045F4C7A83422D1EA20FFE8D36816D90F39B2DDFC1D03ECAC55
SHA-512:	20B954DB12EDC90D44C530AAC227F5B96DEF47CA9217FA9FC74B4AC462A725467B5A190F96ADE9F5E2216921FEEEE5E87DF14616D6F38610B3C0F8C1AAE56C63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=213df4b7a9ce44fca42c00dfd2abd615.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81031FQvUOt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.399153823113924
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvdHQcynrpWJrBGvsS:SbFuFyLVIg1BG+f+M9Q5nFWJNjdCLKzK
MD5:	20312FDF30BA3EA60A44F0A54A64BF35
SHA1:	450E43601E678F2C6770727409D996B6BD3BFE3F
SHA-256:	F515F54D1D4489BA9B104C0043B67DF1AC2D1CF88666B619D2F4E3A6F5C2531C
SHA-512:	AD9CB4F26475A1D7199D65C619DEBCA5D2348F6CDFA3C420C80DB3A239DEAC4E34E88E2414CDEADF6F1D914F830EDB6F8A12DCB61247F15416FE37E108ECB035
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e21deb595c5f442797aff7c3597a62dc.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81121F0rR4q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.412875952403944
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+2db5MR0dR+H8Xsjx:SbFuFyLVIg1BG+f+M+a5Mm8josQu
MD5:	2A432890B0BCF93BD9883AB17F7D9955
SHA1:	502DCBC8F6013927CA0FF5A92937AB85CAB8AEDB
SHA-256:	15EDDF011529AE5DF9368AB6868EF8C64A34FE3DC072C1D3075BA8B1B3C194F4
SHA-512:	10C8BFEB6EC73FE66CAFD759C3A91C3812C844D8BABA29C799730097D5ACCDD1F3C8C7EA2BCAF096B4A08A023F6D87280F72FE4AC3AF41B50EFE283E36070DB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e648625451047aa83dcbcaa633fb5a1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81245DjM4as

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4493295229339624
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MgzjqFPEjZcHcljX+:qgFq6g10+f+MgJmAu
MD5:	2F37F8933D3BCA601D125D9DBA9159CA
SHA1:	A754CDA2CAA638820B0447EF8F40A1F5E0CC2DE2
SHA-256:	79030793C6578EA9FEE145C7F46CE6D2D828CBC72D7EEC017C75E7F5FC55BA6F
SHA-512:	C44D984DF16EFE76D5EE84AEE89CB20845AE91E4D9F684A2A8D373E60B028E2A1FE4EB5FDC855A69CE7A01547A74466BFBF04CE7C66EBDA0087EAC64EB72A246
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=10c9b1d3250e4ae88fd34d2eaeaeba76.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81439UD3b1s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.403618255368642
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/obPZ9FdNusZjs2ALAQ:SbFuFyLVIg1BAf+MArZ9Nu8jNALyAZD
MD5:	6E17D353923FD09C411967CDDF6C58E6
SHA1:	06DFE8F1A357D61C901B0AB4495F559927843960
SHA-256:	E70C96C032A3668EE8425D3C3AE1D9062C6687CAD51BCBBB9408DA43086CFFBE
SHA-512:	9F7EAD68605BB2E7A5018096F2294882CD8CF9BCAD3B945DF003E83FDED7892B9BA16FE56A193DA7D01F8FA903B1697353B71545FB4F67F46E312330802E5292
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ad16e48eae94bf6bde6abd68258e265.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81517GLWZiu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.442462001874769
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyDtnTDKJ2jNdQIeXD:qgFq6g1af+MG1PK62D
MD5:	26B59242E1F3D826B88CCE17186A62E0
SHA1:	035FC19D94F72F76519DF5897C95300D45DA53D1
SHA-256:	655711AD59A74576A15327264F36F14535B811BA2EBFBE04781523328D642349
SHA-512:	B4A496AE4B05F4FDC4578CAEDD84F3F0E3B1DACB539A614743F8EFEFBF46C19FA4215491CB7FA830CCA6D04C9CE20F8F93784E50699E8751728A8C7F31DFDEE7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=806bafed3d074aafbf6f72726daa5844.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82179zLmZAH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.429743598521185
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvfAxSDfLIyjswxJBU:SbFuFyLVIg1BG+f+MnAU1jLTTIWTIL
MD5:	050B046722C8F7B97317B4970196A064
SHA1:	3B2BAB49B792EF6ABE07AEAF5C146C19304E3AC6
SHA-256:	42A0B3069EF9D7624BD2C42906E2CC602D9E1C54A46C3AFB5CD31E62CFDA07C7
SHA-512:	CF16B2FB33203F65FA6F381367FC2DD7647E9E71CB7BE76214C97311CB135AD45194B9EBFEE7402C3DF6540B64630CABEDC41EF54CAAFE76B22058FAB462C048
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e7d5f3b193cb47fca7e2a3d0f36d6b26.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:821873T5F6D

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.409443894132064
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzFVc7zhg2jshKJvel:SbFuFyLVIg1BG+f+MpVWtTjbVC
MD5:	2418979E68B416656E1E3BB4D97FE51E
SHA1:	78480398F7561EB285B2A632E07AB22140BE4AF6
SHA-256:	956D95B0DA94D6B22CB4D1E5C48909667C3DC11C7FDC0E58BF26D405CC6DA322
SHA-512:	1ADB93AFC67878EB6D48B8AED1C9AB2D88E15E9F55586E1DAFC51570363B0C0C5DBE16F02C9C694D57085CBD61AFD94A64C8A9D946389A0112C9F307483B3E03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d53884aa0404719bb7b1cc64f40b07f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82211ZAUIiF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.416932732110031
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5sUEEBWHyVWXb20:SbFuFyLVK6g7/+BG+f+M+EBVWjqjNq
MD5:	670A4E9A8EDDB399775C02CF0BB15C4A
SHA1:	63C4BEFC6D41004248057664FB45A6BFA5BC152E
SHA-256:	2AC65CAA4778E6958DB7AC185A5FA1CD15F6B9CE3FFB65D2FACD05EDBC1A48E4
SHA-512:	72BB74FE3951688B6F8E3C660BBD62DD1701247C6F1F8D34E44E68912D1B4F423C7210DD41AEA5D23E8589634C59C030F4FC1146BA3394001CE3530A40C84BEC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dd9833fad5f4bf8a032464918366425.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82212R6HOIG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.406247152828324
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmu0ziSxJdXDSuqjk:SbFuFyLVI6g7/+BG+f+Mu095XDSuqjNq
MD5:	DCC61560D116F69E0FE8A8F412BE96CE
SHA1:	239AA3BEFEA05AC4084A96BA56316755DCA01635
SHA-256:	A76D683CFDB36BAF09AF4F1C1C16643DA026446D3EF25A66911BEDD3B856C6D5
SHA-512:	F2597550B096F72398A7056D1C1D1E4258D434AB36EAF9B9554CFC24F6B47CC1032F93F735B1E654456F4649E28AEBDF3F78FE9A4F5544599AD8E723AB417029
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d0a157880a2041b7b4a52825329ec975.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82238Zp84mG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414546346524417
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9lERRghRBsjsicWm3:SbFuFyLVIg1BG+f+MwjghRajZcHBrt
MD5:	1FE18C2D8FF43BD2072AE1E7CC9644E5
SHA1:	5A89ECF9C6C75932034D67CF1D766FEEAF261C4D
SHA-256:	9D1CCD6027F77F0C39066E3704DD023DEAB327AD044EFE3115860B719847D8B0
SHA-512:	2AEEF81D20C72CE17733F0D2A74CFCA032F1AB59D8C3C6DB672C6647DE6D3861374E326E521FC38C4BD99BB6F37905D9067525EB15C826DAB58A4C9279F9E437
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=773dd02a879245a5982ad26e5698b5a1.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:822400LqBXG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5228696966740305
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuJSRIU22jFQMzKaBu:qgFqo6g7/+0+f+M/RItETmh
MD5:	FFB94FED7F06EEE4E33DAF301738EF0F
SHA1:	020AF1E439F561519BDF9A878192088BCD6F21AB
SHA-256:	F675F225FA93F91D3D810F9A63C55CE571D28C7BA359B7D36396A6371CC3606B
SHA-512:	C53DF79AB97AD10B09C7562793EEDDA116BD1A4A73D9A4C2F119A40329514DF9EC1E710CB8F6D37F9BB228197D799CFAF36E20D1E7A874D8FF27408C18038766
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc7d3d832afb41dca57db239e329458b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:822424bFkME

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.539383653932891
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MfU8sMqjFQMzKaBu:qgFqdg7/+0+f+METmh
MD5:	70D0EAB05453A52352A39C8340677AD4
SHA1:	FF8566A630E9007811AD491D1AF05276954B9F55
SHA-256:	A8A3B775C986D056E0FCDEFA9AF8E65BD4CA0665BCBCF98A5397A186A02B073F
SHA-512:	C47606A020F023C8FE2D72A2BD39B720BE5847AE1F622808188B5C1EC12873B9F5EF9653D9E6AB4BE7A306BA8C81B9411A8411E94355BE0551484D5FE3B52C5F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c2c2aeed17c49768db66ee58e36f425.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82263upJpUH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392409427061442
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuPwAHNYDhEhglsjst:SbFuFyLVIg1BG+f+Mu4AohEjdCLKzK
MD5:	FCEC3E9371BC10BE02553FEFE2FAA0B9
SHA1:	3FD995D2C769044DA20298AC459E9F913A74FB5B
SHA-256:	6898D3BF3AA1A57298DADC413F15057DA4554BEEA28849F33CB3AA9D5C1022E7
SHA-512:	87A4DD4481307DA793353273CA54CA901AA3AE2AA7E6248FF9C2D416030D141B2C4D22BB11474733E84D34CDE9CA2500C59DDFC4571750AC031DAF92B5ADCF86
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dad11a6a945d4355b20626e80fbd4471.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:823183w0ppH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3929656947520614
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvSqSadAxdUIAJTjsc:SbFuFyLVIg1BG+f+M6qB2dUIoTjosQu
MD5:	84B7B30A31BA5F9A91ED288CCCAB733B
SHA1:	36F3F2449F4A4D06D061BCA820B0B8B1658A7E3B
SHA-256:	C4E8427F10CEBE991CBFFD0AEB7209211E8DD17B332B1AAF730A4FB6219CAF49
SHA-512:	A98990A6F4DD3C1BA402740314E748E2D043EE05095DB02449236BD6E453E0DC98CCFC2D77DF2FBDECBD05BAE2AF2AF2109AA839A51C5056A1CC4897E6E47B13
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e5baf7de04434ce38e63698100ee1949.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:824185dHLZG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4578428790140805
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Muk2KInG8jZcHcljX+:qgFq6g10+f+MUXnGqmAu
MD5:	00DF7A1026134B9737BC600C4DC61924
SHA1:	1AC30A6BD39B847EF86CBC14EE2C4B595BAC541A
SHA-256:	27EE707289B8191C73F31DBE90DF0CFFFCB1AB8DFDF14F82D09ACDE225392C7B
SHA-512:	E23CA1724F9AE5BDFD803DFAFC469655A7684A49D4688E14BCD61BDEAD206F95274112AF579E993B76CF02EEE146E4695B5700C230705E3076010AABC9F45865
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d132f397af5f4649bf5de55ca5ad5acd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:824216ZqlKG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3909350445343724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7JRbdAR5OHdQJdMxV:SbFuFyLVIg1BG+f+M3dyadUZjdCLKzK
MD5:	3B8A750DD5844205204439CB881E4FAB
SHA1:	29A619A5AAC6065CDFD641A9016AC2C02B686ED0
SHA-256:	5FBF6E15FEBB79B73E0B55C20B85152F73633D6AD5E43CA13E19767C0D619F21
SHA-512:	6B0765A41A198CD33842DF9ED3AB49510A94DD694227C8B90E7F589E3D8C4714806AC8D9138B0E42C15ADE36C15C04D291B575F5836A5B1670115356F5120C6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=190e4805908e4066abf843322887595b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:82580v1KIcE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.362997917916733
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmynS3PEE5I0GAY+sjK:SbFuFyLVIg1BG+f+MyS/l0jZcHjv
MD5:	8655BC53B023D2C0AB3F1C4206F6A2E8
SHA1:	6EE03747E3D1D812D7DFA75B05DF9A179E62D456
SHA-256:	6767C90AE59CCA0B6D7BA1252807774497C8405ADB29BAA6756016D2E7A1995A
SHA-512:	3AE0C418B682A71892EF87E5ADDC5E46F37175FF1C3ED7F309070D8BC43A57357A3ABC844E260BF0654D02E4A9573306A430532F27ADE9B5EFE564CC606CEAB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c9a75bb23484af59ca154401c347cc2.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:82985HZ8CEU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.312279975825398
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvRBfMVaohTjswkClK:SbFuFyLVIg1BG+f+MTMjhTjLkGq
MD5:	F273ECB722570F12965547C2E21AE387
SHA1:	EDE258F4F74EDB8740B7B696170BD4939D092324
SHA-256:	452F0463D331C32940C97BE350B9288DC3E676B071CB7485E4450FE790E2AEDD
SHA-512:	A93D1380BE63DE39EF5CDE0812AB0F0C2AF587980AC6DCADB9B0A2E7DD3632F7615E54D88A23FA6FB8FF82BC63850946055C2471C0A3F1B36162242E8935E815
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e03855131d3e43ea9a8aa07e0818b38e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:83336WL8OYE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.504579707546117
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvxEHPUDOeGGITihT+:SbFuFyLVIg1BG+f+MqHArhTji4s
MD5:	7A77CFCECE075E37351CC646DE74ABF9
SHA1:	A20EF4750BEA1517C66F02CC6BBAC4D3A4A07A26
SHA-256:	C6F1FB7B11B348CA981A9E7956E63A0BC5FC7781D5F096CA1C42F7BFFD689B82
SHA-512:	59A4205BC1C4ABED083ACB189F778E72E77A39B68EB6D926C9233EA9F30EE972AD3879BAC79EB5881D15020A155E311C6A9D268542690B9CCFBD1E8D842CEC6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9eabf613a49466489d69fda147a50c4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:83337DcjLxH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.548380279002128
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuyDuRjmMMqjs7LbgS:SbFuFyLVIg1BG+f+MuyDsjmMZji4s
MD5:	73F0FAC38F9BA0FE73C0402D50AA8A2C
SHA1:	858E344712FC84B6D768CE6045DE949B5F1DB5ED
SHA-256:	F45F4A84EA0FA8E2E1E7A1723A9B02CFEA5A8C9F4AF5D1886C6AB8F2C9A38A87
SHA-512:	015117AB5AE9A68B3A83E674AF1ED5514997F8866F287C66F9E5511C6734C72971406E28E3AABBCF71BA8F93BB8EEBA3BF511AF62102BE5987440880CAE8B658
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d450f22755994d68928be868604e34af.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:83342LTjw6F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.423043368637771
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5KEkDQEk6QJxsjs2BZd:SbFuFyLVIg1BAf+MJkDQEwkjNTZD
MD5:	A75C4DB14049F8CD4CD371210E39BD87
SHA1:	85369E14E43B4C5A5584CD210C0974CB61FA46FC
SHA-256:	00C6873A30833DF67599F311BC23FA772B4D71A0D56622BC5795429F7CFB6D96
SHA-512:	C70F20068A44322E06644D2CB1C699C59078902F6C494C76D9C0BF3E7059D522AE342D608FDA2E568E78D3627A7B8DC0B436651DA377D2E7E760A79DAA17BA6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=366b7cf85aeb4c1b92b71ac57d20ed52.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:833490mN2AF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.404270664606486
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr8gX37cTC0ZjswkCM:SbFuFyLVIg1BG+f+MgiF0jLkGq
MD5:	7F7224EE8B781A85F7053420B3784654
SHA1:	27FE671EE5F10ED6A6873A8096444DB2CA47D0CA
SHA-256:	22CC4049C091DE13010AE8A8E4E6ED9B911BA50FBF6CE1613338FE9A52B34FBA
SHA-512:	F385200108ECB3AC7D7E1A5BDEFE379B913EDC148F064AAD4DD5977DE3A5ABB0541B559DD947CA88BE395085F0BA0E33D5A942E46CE8CA100AE658DBB443433A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a03c5e2b93204964ae85ccfd5cce6f79.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:84761SggTR3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.452058149632601
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu/JaStmNMxsjs7Lbr:SbFuFyLVIg1BG+f+Mu/Ja0gMqji4s
MD5:	C33F0E30CFA0304BD4E134F9DFCA4030
SHA1:	A99F3B27463E5A46E0DE01BC6869B792D8B5F334
SHA-256:	F68A54A5B062C1A53F60E56AF8F78A9EE2229933735336F15A412BD67E49E7FB
SHA-512:	A630DD81D6B3E8EFA11A53F22F4001BBA23C05BC4C0463BA39542BFBBD9AFF3C5C3A034E8F60751D44C69DFE7A9B8EDC291D2E82934A2187F19AE24991D4726E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1d6cdfd51704515a51d41daab8a44da.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:847645rnTg1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.391933096710072
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+GcrkjLSDRoNlsjsO:SbFuFyLVIg1BG+f+M+0LkO2jtWL0
MD5:	8B4F60E05B671AE027889FFCE4B9FFA0
SHA1:	9F6B5622A98CA981DAFEF309CC2F2AE4246134B9
SHA-256:	D801D6694A53E455FA3CC56177C0476903A4689D0F348AB692F8C993E8E3EC3B
SHA-512:	EBA2C09C842761DF8B628DE142D634E0DD7E85056CC69FBA3585E8C58F3FF0FF16F338F74E0C721BC403D1B211F98518A914331726B43CE88ECD071AF70A1547
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49ee9d8b502f4e6b85602136b7f41e2c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:84765eSDCo1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.418286424232718
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuLTHlY6Vc0jNALyAZD:qgFq6g1af+MaXIZD
MD5:	94E0A3D5D5CAEA4615FAFEE26C1B1E47
SHA1:	9546AB38D62BD3EB9B0E7E9479EC2798A5B5DDA0
SHA-256:	4AB8EA6CE9923F57F9EEC24CAEC0BA15AD3339C4866F8B17F91A24616A40F0BF
SHA-512:	74247F439F6820D1FA3D2DE5C95A0D8F057A3E9001C6E0F11124DA91BE401A2C22F7BF1079F996CBA19DB045DC53740DE93D2586B620A70A6AE3B19B11AA7448
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da36eb93e2284bc1bda2a9318907a7cc.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84768wrDuZ0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.348051945791373
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/Sy59UujYY+sjsmNm:SbFuFyLVIg1BG+f+Mqy/TTjdCLKzK
MD5:	D44552B2F2251F3D50F17E5685FC2DB1
SHA1:	81CCC7DF978372043995CCCD4D8741DB84D57C8A
SHA-256:	F5A4098E589A27CBAED1D0D64406653D8B1D8A528037E673E669E65E33D641B6
SHA-512:	886CD8D2A06086BEB53B8EFA93647AB8F97478DF1374812995973E226FEA9DF53A18120F4DDC6BDAFA2DC89387CADE6A7899E37B819A874CBF58EE369AB01AA2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=521aa31452b645afa63ecd1ab018e5c1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:84771WE5OJ3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.438018501186552
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9lWWJZyW2Fw0jswkT:SbFuFyLVIg1BG+f+MjvJL2bjLkGq
MD5:	FD58DDF6E203972B9793975938916371
SHA1:	7D3DC5B604BAC537A66EB147A3F2EF1621A0C7B0
SHA-256:	D5C0F86FC02FF3F8481276AF5040937B1803BD5F1813B00A34FA886A706CCEA4
SHA-512:	D234DCA54EA6AD7972F57558C862155193D8D956AF8AFAF4FE4225D154104F7AE920B26BBB8C54F1FBD6089DC611938FCE01677FB1592A013DD15B85D10A5B60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b083cf2c946415a8f14e23098397f26.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:847809qRMA1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.459794967845313
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm59JwoH2BfN2jsicWg:SbFuFyLVIg1BG+f+MA5N2jZcHcljX+
MD5:	5F02FF36A726DC74E69AEDC70558ECB1
SHA1:	A89F7AF4493BE2AAC9C6EAA05036DA4D6F5BCC42
SHA-256:	6B31E5F867D19658D9C62C15CFBAD5D1ED533615601321CAB3C15CE64D81950A
SHA-512:	6FB18EA689B44F13AE4CF347DD114A4741138B4B5B7DDCA4B0A9377C06901BBB761D9F730994AE178D430D0E59F1905CB2FAE04423CF3D4723F55B5B4022C02E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3d6a7c4e2ba543adbc4416ca7e3242f6.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:84781aYopR4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.394797461729371
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5l8XEBBATc3VhTjsc:SbFuFyLVIg1BG+f+M0yAyZjosQu
MD5:	81207B82B5724371829A8AE60660E2CC
SHA1:	F14036ADA4C50CC2F3CF73A109F6EFD2F2B530C1
SHA-256:	33471E95F80753037352275D7BF604E78455860FFAF88EFAF54B6E50A6BDF120
SHA-512:	5E835A94672FB2A50C5734CCFF93DDB72C78EA3B94519B4B0980BC99F1D45CF20D25529BCAC00A1C624FECEBE6A72739C001FA0C9DACBFA5AFC08BF091CA6C5E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3eeba3a880a24268bb5069b492c41a38.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:84785T3pMj1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.489931255102275
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsLgUSS6tTUGCThU2lsA:SbFuFyLVIg1BAf+MsDurf22jNdQIeXD
MD5:	E4D7547430E727F287E71511558318E7
SHA1:	D3BCB6B2AF39ECEA720CFB433330F138F273E728
SHA-256:	3F73B2276C06296EB767482638D3D9BDD620624ACB865C4B6B3B0069F4ABF4A0
SHA-512:	DFA9A57B2F8AF1DA3F5950509C3551A13B24F7876FBD2E67316D9E89C452F30043E60BB3435F0D7799FFD53F6256E52197C189463F3D69FFEC67F9012E198FDE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4f4c916782d477490b6cfc01b8264bb.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84790XZBik1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.555454048209556
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu9iWWRcRw9BaVxm+3:SbFuFyLVIg1BG+f+Mu9ERcRuQkTji4s
MD5:	234D1233F43A00EC4A7ECD3A96AA58E6
SHA1:	4733FF498891B06F5103847C8060F655ED637002
SHA-256:	008B70C87844D62CFDD6F56FA3468AEF6C86D3BD6C594872EE1C66AEA0D416BE
SHA-512:	26CE38F50AAB3D2BC3972A66BB161161783A315EC3A76A9A6C18408217E603808FEDAAE81790799AE21CAB1E449EE88D747A6863A141071456A1E050E8609A82
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc584ad381494e6297d51b0582b446bb.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85029hIEk6Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.389461455657178
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm++yjxBDXOTjswkClK:SbFuFyLVIg1BG+f+M++8xBLOjLkGq
MD5:	7BBA748CEF753B2FE434BE1751EDD992
SHA1:	B489EF4B9324F7079DE53B57C0B36A09C7D2ED2C
SHA-256:	F90CF28198AFAC379DC71073E01D3F100C5CE4285CE5934683E7DF7A1F3BB6B7
SHA-512:	2EE4B85DBA14B5143334A451E3B9737314E8DEC5F728553707230B82C6088BF319B841DDD0FE1F617BCD36C49AFE3734CC8BBCB1ACFEA1009CC16A7A4D3433B9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4113284647d2433cb48982d243a21269.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:85107bgeteZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.352821416622509
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8AdcEVTFLmkDUDqosjr:SbFuFyLVIg1BAf+M8k1VZmkDU+xjNTZD
MD5:	FE793789F4AF890BA8BEBDA908097581
SHA1:	61D0DD41A52A3552E5631E3DAF37E5C7B92BDE5D
SHA-256:	D5EDE72FC056FCFC8604C2ABCB0668E1C1C8961B3C8D5168ECC034C53E7B409B
SHA-512:	C4D492C48D23D269557E16F9EC7FB8327D07ACFABCF426DEA0F9221EE7A756BAAA16C9402A22308DC46FD758F8484E45ADE207F6696B893988D4FD682F17BF90
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e70aae9a06c47cab92d73a1fa6d1220.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:8511637TvnZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.381779130251246
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsRYXdliv+xsjswxJm:SbFuFyLVIg1BG+f+MsWd8+qjLTTIWTIL
MD5:	488FFA7729571174CE753A1C7E8E0284
SHA1:	45A3BB2C1360BD39B73C8AD62082D47937F28BB8
SHA-256:	12C61BC4510E76752A3D78AA8EBE60911AF3FB77279369F440C5651DBBEEDD71
SHA-512:	3320C7B26728734F53AAB92E1E5FEE0A2F899051249A255F1782DB602EDC19FE798AD2EC512F2B5317D3EFBA00E7DEE22486E5E44DEE5F7A5A8E06613CF447E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f5ae8c182bfd4fae8cbfcd39841cee1c.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:85136aAt2P0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.419813147883637
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyLGxCKUlYUWGIjbVC:qgFq6g10+f+MAAKDWI
MD5:	60F4AFE3723EA93AA394D85B76997D21
SHA1:	CD4E2FC82F07C6252B9D20D246996E55312EF61E
SHA-256:	DF16ECB0443AFB9A7BB0FAB57B1B6BB6A09564D227E97DA7B4152771A335185E
SHA-512:	57567AAF0991EA1A9A3144A65ED4AAF01FE7EBF6BBCA5FC77A660439F8B782D2AAC11C09D48CC5914FC68071856F52760D6594C3A7751E927BE0D3A647530477
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e90cdbb692747af8391d6ed5c013cca.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:85160KZmJZZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.424807637511516
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsMn2mbf2js2BDf8:SbFuFyLVK6g7/+BG+f+Msi2jNq
MD5:	C476F118426AA8EB8CC952C18858DF2B
SHA1:	7DD572E1798BA34CD94F6EC8740A724D4E32B3B2
SHA-256:	A438F79E7D7F09BB8783D011AD3F4A8D444CF67510A632D4BB2722A447BF649D
SHA-512:	D0F16ECC76BA3F68437CCB25E3D365B4CD79BFB8C02B863FFAEDDD19919954BA98A8BB48FBAF67B0ADDA2D819FB8DD61AA86DBE297C71138E87CBE95334A919B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8bf74d391f44d518dc41c1ef24ca40f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:85161wdRiM1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.44318614482164
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzLTQSoOWiXvAgrp:SbFuFyLVI6g7/+BG+f+MU/OWW8jNq
MD5:	E66228C5A1CA455BA10D0F9C870A926D
SHA1:	D809CFBC93A6CD562A862652BBD38692BA9A25C7
SHA-256:	8F3A0F4B8F1E6CF64282355B7276B4FE3646D900C5EB64C80AEF7D87C7CFA0D4
SHA-512:	8FAF1312AD7D553A22ADDEC53B77E3697467270935863113AD13D40B71B34DCD50D858CC2F8B565F71FDA870C1A4A552BA0FB20DDF8C39FF0CB14A9068A82402
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91b1702355b84a6aa8ac3f2564845572.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:85165n801m1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.346286215314167
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8STWO9QWvRqjdCLKzK:qgFq6g10+f+M8STnhRgCLAK
MD5:	3BFBFA8B22F8B03D673B3C4E8E6F4FF5
SHA1:	31F19BE523578E1F63ED4B9D99A8D3ED19FF842D
SHA-256:	C04CCB452BF75D56F424725EB262399CE7C6D6822B48D451B703608F8379DC76
SHA-512:	15E094EDF44EB971B40C286C04F4F7C186294540979A916DF7B39C2DF2B867474A8167F612CFDFBB65283A1425754AD5B0F178630980AD1286CCC653156C9EDE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=64213e3b302b4426b55b2bb88cb4b083.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85264iBOuh2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.454516515760175
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GAqzME+VrqjsicWg:SbFuFyLVIg1BG+f+M86EMjZcHcljX+
MD5:	9A28A9D981225C57F4D158CE9EA350CD
SHA1:	86B0812EB64BF9813A49002D8B4469A293980C89
SHA-256:	D69EA723F3E023A41809197365E43E6BB4FB7CA8BB0C05FD0C84F1F991B090CC
SHA-512:	F1A3519FC1A8D6D315266F0A777708033340EF505EBD1D9E0BFD1270B92051BBF265A2D3BAE9B4202E80F78A2D54944A0F27E8B119B0A9E9E268FA951DC090F9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ce3c9ba19e0410a8c27d8963d092c16.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85946IHEZBU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5443589246011715
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4G8kH6D5H71Hpv8jq:SbFuFyLVIg1BG+f+M4Vk8Hr0ji4s
MD5:	5E8E3A0BDFA0CE6390292F0F40A1D1F7
SHA1:	4105152926757B0C34E67A9E1CF5BEC6CCD31AA9
SHA-256:	43873D632DA937F8D8ACE1FBEABC9527A7F0CF00914A91F3DF9EC52252D42E01
SHA-512:	AA9324846AA0074982CD6224E6D2AAD01E56EF69B2E1695EDCA8EBFEC23F044F17A476DBCF4BB690C0589C928337F325DC2CF0C5081F768B46C1BB4A15566D1A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c03e7bed8c549f185b26b52c46a9bae.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85947j2oXyV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.410689768854291
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvBjHmXqA+UABtsZjs2y:SbFuFyLVIg1BAf+MpjHGSU28jNdQIeXD
MD5:	150E9B062035FF21DE07744BD23DBFB5
SHA1:	C7EDE31DDC6A8CDBB62A3B6020D07EB9C697411B
SHA-256:	65D2E23016F3EA889CCEECD16262136D23535BDF4E20E049116D612D0A666DFA
SHA-512:	6CDADDADE41C2A62AF362CE85126E4093DBCAE816D5853A5B0CC3EEDDE15B11B83EA61A64C079AFD5ED8D53268B7A1F3B05D86686560827ECA96575EEC724F31
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e2bccd0befce460dae124405f16dced8.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85948KbmI0V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5390479513050535
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyadGZWQQRzE2Fn2jq:SbFuFyLVIg1BG+f+Myadnp2ji4s
MD5:	FFDBD13016E675CEDC4317D7870D49DC
SHA1:	59FD929139E9583B3AB2FB35F27545BBC1FCA7C5
SHA-256:	EAC582CEC2A0422E9334A075E506D3EFAE788EB3216F7CF7C41D2990001A1BB5
SHA-512:	B130A158FE7744170E5C3B34B6A6FBFEE82906DA00F4D3FF38BFBA425D25EFEF4080A8AE203EBE8D38A041D8E953607F79B2D598B34000972E84645540F7611E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8638561e38754b8aa180ba1f960f2246.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85949a9mrAS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.400349256169151
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MczT1gEtdtiZjLkGq:qgFq6g10+f+MQT1PvtLT
MD5:	A643D094C04CD641EF0ACAF3B74B871E
SHA1:	3A0635E24A0D48AEE44F161E510BE4D5F296B184
SHA-256:	92C5C2A945697A0BD8A24E76F9DDA5E7EAB4A3514FFDC67317FA8E7C843BEFC8
SHA-512:	C753E23B0482A06FC749CEEC5923A5AA5ECB16B88392CBD10188C6E2E9794DEABB4C8B1CEF18EB3273C5175D64CCA03FBA7A6141FEA3B1E04723396ABE3246B5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72340d3fab2e4d5bbcb0c6ef8385d304.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:85954XnFGaT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.454970449715221
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MpfEEFsN2jZcHcljX+:qgFq6g10+f+MpsEFsimAu
MD5:	E8ED643EE47FED2B6B3BC5B15E760208
SHA1:	6CDDEB5F87DEC0E1D95ACF08CE9D64FE250E80E2
SHA-256:	175F4F14A9F43C09CC462A46BE06A1229A8A6267F0CA3D0EE4434AA4981611EF
SHA-512:	546DBF9974DEF9D65358F98035A6ACAA39B0188E0403DBBD2F62A400ECAC18945463A68B2A8158AF9AB73A69B36D3276E9D435E71FC79F9C084284BE603909CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c327809492974631aa333acee3b490d6.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85964WLv6EW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.412321491725271
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+9xG3BxsATjdCLKzK:qgFq6g10+f+MlxlVCLAK
MD5:	0C04CEFD48156B58FBF84E0D98B497B6
SHA1:	664C940C468A81B0229857CD380A43F2D06DBEE4
SHA-256:	3A4EE69955B2E91923A8426268736E0F0D19D2E9C1F9A1DCBABD09B6B36A44F3
SHA-512:	E466D09F5931F1DE0206AAB65FE6562C807FEC1C90838269EAAE6DFBCA56ED18FC3148046B783E31277E6197380CDA2185854C524612BF7FEEA2BCC88057E094
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=42d95a0752f6414dbda09cd8f1730581.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:861420cYwzZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.533755660132112
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmspBfbgDkqjs7Lbgw3:SbFuFyLVIg1BG+f+MspBzehji4s
MD5:	9F37C386CD53C8155B4676CC03523388
SHA1:	EE11E37785586D987D5660DD2DD8543E4E08EB7E
SHA-256:	7A67D5D4817AD54D66CACB6FDDD7326876F7EF916D1A318D4015AA8750944EA2
SHA-512:	0C69793C82AEBF518F772D6069556919854EABFC8AA5143A5F5B9DB4BFB0B5A17B1B0A696EBD711408B03DF43192D5B61FFAF199024BF11168467A04577F9A4F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f493fffda61d48dba9b3231bd2847644.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:86143IUASD0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.344193660307572
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvOfEfSSVfshglsjs4:SbFuFyLVIg1BG+f+Mmf0fsZjoa
MD5:	4A74461524E1948108E1E43BAC1394B7
SHA1:	761F4EFFD6AE1AAD1117BF65F8C57C8430831E4D
SHA-256:	D5A8FD27630867246428E224BA7CC158A15B8886AB5376005CAE05DD88F1CB4D
SHA-512:	09573A07E47DB7755E3CB47927C7D7147228344DE33B771F682F55B6CF46D98871993A9ED06BD980703FDD540CE0ABE50C5503DA2432F4540C96B96E951D4D05
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e3c9483b73be4994b00a88730e6f94a1.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:86144Kxvgj2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.507225853132589
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MgH5hTSQ2TITihTji4s:qgFq6g10+f+MgH7SQ2TIejs
MD5:	F95202633B3623B0F2AD3671D77592A0
SHA1:	0D0DB754ED825AC2EF2524FD3021A4C3F6122211
SHA-256:	B2FBCD47D26900D1FF8587781D4D36FDE4030E95CB60B8E8971D4FFE27116E01
SHA-512:	E5812E3B400A03EB756CC7DCF39083243FDBFF9B34447746F217E84D2A9B000346EB69E61D6F3448ADF3D8DE47C059D9EB7541C46B490F14068D61CC008B8903
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17a21b1c44b844bcb5020c9dc22142f4.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:86583hZK0I1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403387402542944
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MeiS20XRYTjdCLKzK:qgFq6g10+f+MZb0BmCLAK
MD5:	A60C24EE630066AA1FFDA8C8C5FE0448
SHA1:	76FACEAAC45D93D1D7D6C6511FDF473C969B573A
SHA-256:	AD773238612BA7DE2E35C39C7776FEC2CD5484D85019A09DAB2B1C4DB7490AA1
SHA-512:	DE6C41B5FB49B1DD14A971CB6BFD33CAD2F3E1D3A5AB6607CF873827A7673A5F07BE8A0BF65C67988B977C86858A260582FB637D93B632E5C76CD09A8AFEAB27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b1b3a25b4734f9bb8c4f357329b5814.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:86597ytYULZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.394517164675537
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4M/MRy2o9pF2js1Ha:SbFuFyLVIg1BG+f+M4MkRybR2josQu
MD5:	E43ECEA0D2CD1BC9962C793BFAB3EF44
SHA1:	EAA46C80BECF0E6069DE4231EFC6BC9E29C6F79F
SHA-256:	3EF8D0A2567ED52C3BAA50BB9E5C4EF2A05548195E62A1BF1BF154B84E2E7779
SHA-512:	113310CE9A3A6F0BBA94B04AC6D9010F779808A15AEDD39D17C4028AFF7774A57E3E75A2F01D43601D476D33DE4BF04E324AC452E2F4293EB6452C5A79FD68C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26e062e6af6e42d283b5f63f848d02b4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:86715XMexM1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.407212957759897
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MYDYuRyaZ8jNALyAZD:qgFq6g1af+MuYIX+IZD
MD5:	CA1ACA79ECF319EDC717ABB70CBA8453
SHA1:	822DBFBCA7F37C6BD11DDF5D6F3D57DD73C7518D
SHA-256:	B9111570DB8664D3E1B4BF394522B400E1FBE3FB46287638B958D03AC555DF33
SHA-512:	D276815A9FFD4255DFC84FF5A594DFB554F3CDE3ED0EA7FA8400A5D6ECDA272ADC3638A124EF18989B7111A0F2E04D09B668455D7CD5CF9F6D4DBA044D035AFC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce2f5d4b7adf4f4bb090ccb7c42071fd.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:88106YMG2aS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.344422678954048
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9fU7cEAAcxGPYgrqS:SbFuFyLVIg1BG+f+MecE0GV2jdCLKzK
MD5:	9F60CEEDA963E8399CB87B27538BE11C
SHA1:	38A37E9B7A5C3F3D640AAF4A1D5E5EEFE002F883
SHA-256:	ED1E4D8CF262F515CBFC65F1916609A5C36705FA01B5404DDB36EA5342FD511D
SHA-512:	45760F3E560C55B48D1A4F0EDD6B7627DF4B77AF47981359853473A0D04389D6F60A1445271527A9AF69A9DC90EEF8D9B3772A03FB59F0FDC3F43A30DA308691
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7189faa1049a41b1a095a89ed49e1c6f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:88196qQ1nIU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425375210873144
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/hpzIa5DVTSWZjs16:SbFuFyLVIg1BG+f+M3IKpZjosQu
MD5:	12F4F8F12597AE5023F0DBBF6BE4315B
SHA1:	1886F39F0629AAD8A0DF888DEA0DCAF4018EB3D3
SHA-256:	5FB836A5BC49152B830BA6AA58CADEC532837EB955093A43B5796EEED65BF938
SHA-512:	82CEF7A4F69D85CFECD2270D00B6BFCEC0388E468D7FBE2D4E79DF41FC99CA6A326266724ECBEB27D2D72E0C4EB61CCB596AB27CA99B641191F3D78B56BAAABA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ea11847e39b43f6b49e9f06146c9a74.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:88329Bc4bOS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4856869563735025
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu/3T7jcyjZcHcljX+:qgFq6g10+f+MY7csmAu
MD5:	F94324A83D66718ADDD273A61F327D72
SHA1:	B76BC591C07696CE96B39C685F6CCF68C86734CC
SHA-256:	10603B8BA79177B0BCB2AD1012A514B357F13D99AD527E11DF34F1DF80499521
SHA-512:	657F7B9DE5E42FA473DA031586193BAD993AA0C3B0CBABC6188F6B88CDFA06E64DD3F50A9BE6449C9101E57A24FABA9282E1D9E022AAC9A05551514299F9EF48
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d7e6dd9606884013b1a26a55487596fd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:88438kO9G9T

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.382340527079432
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvujP5MEmHThglsjs2BP:SbFuFyLVIg1BAf+MGey2jNTZD
MD5:	3D24F2815B4595E7A9CCF836828E1820
SHA1:	170FA7ECD4921D478FAF8FD4969154B8AA56D03F
SHA-256:	D38E22F0435757CB9F11B0C6C6F9AA948824E96370FF27E098C74771EF2C36D2
SHA-512:	0B629505939910992EFEFCA35AC4899654F93A98294AFDA087AA559EA53CF21C48782CEC51A944BC6803B10A5566477E4B31D20FF874B63B798A37E9EDE2C428
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e82abff606bf4380a223d44a0a89122c.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/seats/.#seat05XO5pi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat081RyeA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0K6kV8g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0KG0NVP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Kay24K

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0RzbiMX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0WaCkjn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0jTuuxJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rKUgnD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wvpuMM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0zw7deu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127F9tdAg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313231029058102
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gRACQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gCgthQHtPYq9M
MD5:	30BDCE1046B399A4028CF248B973A19B
SHA1:	D8E44A49C325A96273B21FF57844161AB8C5960F
SHA-256:	AC6EADCC4B6C2A03F3794CFA8B5AB14F9CF179C402630F18B023ADE77434E5F6
SHA-512:	5F0131102B116109E1DFA75A9BBE625ABF493806FF25E0E863EB0B4B9E54CAE49AD894E0550980F88E03676B3C0546C342F751F460DA15E0F1F3621FC4EEC7B0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1733759917817536.MONOTONIC=461684088.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127HZkraj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.479730817908304
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgRAm5t6FQ:qgFq30dABibB3TgCCIu
MD5:	CDE8557F74DCDC0C8B53EC94052AAEB4
SHA1:	086CD122F31B922AA13B71D15CD77D07E316EF6C
SHA-256:	644E144A472A9B3852C031A86D9D69010A685AA949AB450370F12B341370CDE1
SHA-512:	1644A9F8B5F2650508CEBCC40632E1924B9101A5E6DBAF41E10CB5FD203627E7AA1A42F2E0F780945DFF78C3D7465114F85B01347117E3A92604BF5C77DA649F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1733759917817536.MONOTONIC=461684088.LAST_SESSION_TIMESTAMP=461781906.

/run/systemd/users/.#127I4sEoJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127awdtJL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29089203469523
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffsJgVUVUQwdUdh2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBCg+VUkKthQHtPYq9M
MD5:	637B611DAE28A5B5EC51860CBA8EE8BC
SHA1:	4AB75CE209CD96CB7D8CDF06347F2E78A5B19BE3
SHA-256:	F79B220CF70DE31ADCD5EFF29FBC2B1450C870F066A400A41D7E3C319D3BC357
SHA-512:	F168CDE1A54AA485E6BFE038C165F152A9FA3AFE80574D3D803D07B4D32EEBC6BDBC0E9034FF89CF822D9F4CB8CF5667ED017F10B02357CBC9B0BE5EBFB508EB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13784.REALTIME=1733760014314266.MONOTONIC=558180817.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127bWccPg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313231029058102
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gRACQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gCgthQHtPYq9M
MD5:	30BDCE1046B399A4028CF248B973A19B
SHA1:	D8E44A49C325A96273B21FF57844161AB8C5960F
SHA-256:	AC6EADCC4B6C2A03F3794CFA8B5AB14F9CF179C402630F18B023ADE77434E5F6
SHA-512:	5F0131102B116109E1DFA75A9BBE625ABF493806FF25E0E863EB0B4B9E54CAE49AD894E0550980F88E03676B3C0546C342F751F460DA15E0F1F3621FC4EEC7B0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1733759917817536.MONOTONIC=461684088.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nhSuYI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29089203469523
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffsJgVUVUQwdUdh2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBCg+VUkKthQHtPYq9M
MD5:	637B611DAE28A5B5EC51860CBA8EE8BC
SHA1:	4AB75CE209CD96CB7D8CDF06347F2E78A5B19BE3
SHA-256:	F79B220CF70DE31ADCD5EFF29FBC2B1450C870F066A400A41D7E3C319D3BC357
SHA-512:	F168CDE1A54AA485E6BFE038C165F152A9FA3AFE80574D3D803D07B4D32EEBC6BDBC0E9034FF89CF822D9F4CB8CF5667ED017F10B02357CBC9B0BE5EBFB508EB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13784.REALTIME=1733760014314266.MONOTONIC=558180817.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oornsj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3231261502997285
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGZ6S+x4Bdk2g206qodruUk:SbFuFyL3BVgdL87iesnAiRJgRAm5t6FQ
MD5:	914BFFBE111DDE933509EC19D59AE4A5
SHA1:	E3C8E56FEFF8F19E7189827C87E66DACD201B61A
SHA-256:	95637AFF54033DED58040A07F07E7CAA9CB20CA304A65EB39BAF066CFE99E8C6
SHA-512:	9156060012F482481BD36B00AAE01DA2967CFEB220257D6F7DA34AADE7B74A1747FDE76876A0EE2C38A5D070E843619B9E001E54357C6FFA8B41CD34CD906D0E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733759917817536.MONOTONIC=461684088.LAST_SESSION_TIMESTAMP=461781906.

/run/systemd/users/.#127tYy1Hh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:dF:/
MD5:	C3F93758F43291F7D5F273DFD4EF2FED
SHA1:	C3908BFC6171C0D1A74F8AA138F4B74D6FC009CC
SHA-256:	D5E006D6657FE0BB8F342EC41219A683F86C7627C176DC25BECD399DE694DF5A
SHA-512:	510823E3631BD338E6E2AC864F90D5C87DF16A09F234B3013C1EED28F2515BFF85A864755614E686618120D1926FCBB1E3D6623A3065CC62164E5FA003FB9AB1
Malicious:	false
Preview:	6330.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:iCsXlXEWtl/Cl2sl:Y+ylqJl
MD5:	EF44BF3717B273051305269CC75F2729
SHA1:	765178E9912B64D6A723143C5BF4A3CED86D04BE
SHA-256:	7A814B315A23DBBD276F689F9D2959C28E20BFC69F4EB5E236DC9E16C0848B48
SHA-512:	E9F3B9D2849BD06F56753E1609C086B32210202486C3721EA2617E9750FCECC7F53B5496E51DC99629309DD02B083A3E8E47FB158F0E29F504EE0B80D114037B
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.................................................................................................................................................................................................................................................................................................../.Wg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:D6:u
MD5:	C71A9BD11D62274F52E77A40A7E30A25
SHA1:	863B2381E8D7EB456FF62E7407C845668372C983
SHA-256:	824DC8A7A3F6425FF3C6210981FD7C490E00F8D9D249F583F597AA52743EF5A6
SHA-512:	C9623B07A97E48E1448FDB3864FF2CC3AD7CD023F1AD0AAB579167B8E555EA67BD04E1AE3B73EA87540FE84C84AA39195CA044EF38C49088EA0A0F4E3446D512
Malicious:	false
Preview:	6935.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mLtn:mR
MD5:	A01BA87B7EB30F4F454652EE50D10624
SHA1:	07CFD61C285E576701A869227DB210F559FF0CB1
SHA-256:	B51D28927454724717C1F40F7F52A80383FC76C97E55CEE23836136D7977A349
SHA-512:	5BCAF7E3349D8F207D226460150BD2609313C2DD7CEC75F283D8635080EC74F6DDA942573CEDCCF46ED38E3F2394529A7A2BF8A9229E1F2C686DDCFC2267D00C
Malicious:	false
Preview:	6843.6844.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E6:E6
MD5:	928216BB2F8BE663E3FF723E27617461
SHA1:	44F1513886A5F7FCEF125D69641992B90233B528
SHA-256:	FA8EC8A196550DA40E5DAA793D0F2496CD1AB8FD7F132C8CB5695705ECD22682
SHA-512:	4548AA2C5DC15D6E5C57D60C53E5F9C02685227608BB5BDD7E6C1189B7D0D317000EA6D78A414D64230D733BFA05098D75E328FBD87155155533EA0127D6A48A
Malicious:	false
Preview:	6945.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:D6:u
MD5:	C71A9BD11D62274F52E77A40A7E30A25
SHA1:	863B2381E8D7EB456FF62E7407C845668372C983
SHA-256:	824DC8A7A3F6425FF3C6210981FD7C490E00F8D9D249F583F597AA52743EF5A6
SHA-512:	C9623B07A97E48E1448FDB3864FF2CC3AD7CD023F1AD0AAB579167B8E555EA67BD04E1AE3B73EA87540FE84C84AA39195CA044EF38C49088EA0A0F4E3446D512
Malicious:	false
Preview:	6935.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mLtn:mR
MD5:	A01BA87B7EB30F4F454652EE50D10624
SHA1:	07CFD61C285E576701A869227DB210F559FF0CB1
SHA-256:	B51D28927454724717C1F40F7F52A80383FC76C97E55CEE23836136D7977A349
SHA-512:	5BCAF7E3349D8F207D226460150BD2609313C2DD7CEC75F283D8635080EC74F6DDA942573CEDCCF46ED38E3F2394529A7A2BF8A9229E1F2C686DDCFC2267D00C
Malicious:	false
Preview:	6843.6844.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E6:E6
MD5:	928216BB2F8BE663E3FF723E27617461
SHA1:	44F1513886A5F7FCEF125D69641992B90233B528
SHA-256:	FA8EC8A196550DA40E5DAA793D0F2496CD1AB8FD7F132C8CB5695705ECD22682
SHA-512:	4548AA2C5DC15D6E5C57D60C53E5F9C02685227608BB5BDD7E6C1189B7D0D317000EA6D78A414D64230D733BFA05098D75E328FBD87155155533EA0127D6A48A
Malicious:	false
Preview:	6945.

/var/lib/AccountsService/users/gdm.5T5JY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.7CSEY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.NWS9X2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1718
Entropy (8bit):	4.851036524175576
Encrypted:	false
SSDEEP:	48:wf/fafDf5fUf4f9vcf9fVyfQQH0u5TcvOcfVUO:QnibJUI9vM9foAv3fD
MD5:	58BCBE45EB66D9B05C49494751D293B5
SHA1:	FD7960ABA57AD0BB84391CA89B8F3F1458F0F9BE
SHA-256:	38196BFC0A4994DB494AE1DC69EC3629817F1CB9C0B3F9D7047C16AF2D749504
SHA-512:	75D65A221A85761098C1B4652C4735209CDF149216BBF3BB0EB25F61FA0B405989914F45D3AD6FD8F68E1DDC8228B8272AC75AFF457605C56D6B4A6447714289
Malicious:	false
Preview:	Dec 9 10:00:52 galassia systemd-logind[7175]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 9 10:00:52 galassia systemd-logind[7175]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 9 10:00:52 galassia systemd-logind[7175]: User enumeration failed: Invalid argument.Dec 9 10:00:52 galassia systemd-logind[7175]: User of session c2 not known..Dec 9 10:00:52 galassia systemd-logind[7175]: User of session 2 not known..Dec 9 10:00:52 galassia systemd-logind[7175]: Session enumeration failed: No such file or directory.Dec 9 10:00:52 galassia systemd-logind[7175]: Watching system buttons on /dev/input/event0 (Power Button).Dec 9 10:00:52 galassia systemd-logind[7175]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 9 10:00:52 galassia systemd-logind[7175]: New seat seat0..Dec 9 10:00:54 galassia systemd-logind[7242]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 9 10:00:54 galassia syste

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hlm2fDiHll+2fDiFll:F3W2b72b6
MD5:	446EE4F36079F19E8F73E1D26529D2A8
SHA1:	23F7350FADCA072167B0B0AE7E01EA8C68B838AE
SHA-256:	D00276113AC6D0B21259A232A3B6490AC69327BD014213CD539E8E9B71FF6293
SHA-512:	6B07CE31A336D7766252A02B4C2277D87878FFDA7F8714BDDC9F313E7B7A4FE4E684C80CE40A39E4866FCCA42D79C367D57446403CEAD1745925908982FE289E
Malicious:	false
Preview:	LPKSHHRH.................>.z.0L7.........................................>.z.0L7................................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlyNrrtCNrbt:F3ijCz
MD5:	0CFAFB2D672CA4DD53D3A8D7D48D7F19
SHA1:	10E1B6F3C05E53AE759C9BC8DE0C5D1FB3F28D5E
SHA-256:	8827D440BDC7508D2995EB6A4E3673BDE119386E23293A8A8C2C8FB7D6532ABE
SHA-512:	937CAC10D59E073D6D1865C6E1A6A1E2552D4A6200BB7F0E7166AB4C407142769072FE5416894794CA93006D973653F893887E03F790AFB9E200BD6585D3B757
Malicious:	false
Preview:	LPKSHHRH................X.yR..M.......................................X.yR..M...............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	610
Entropy (8bit):	4.641227559854309
Encrypted:	false
SSDEEP:	12:0+FUWQAIAKqEqgou+FUNUwAI7lcZu+FUCAI7lcSu+FU4VLjAIolcru+FUGAIkqdg:mpAIHq4PNUwAIRc2CAIRcp49AIucAGAH
MD5:	79D1883EB48225AF5BE48E6139C419A9
SHA1:	B4ED2D03A0283B1A234C9AE59EBF8B4CC311E196
SHA-256:	26F19374E3E681FC611842673EB733DA55DCE2473F774F87E25BFA8D96022DE4
SHA-512:	BB4EE07B9545AE0661A30218AF77DF46A8BD59DD59DF5D530BDBEE07157FB77802E5BDFC672F11019E6CA3E9731526E73D7D39065CE214EBA43E2F4D97E3C274
Malicious:	false
Preview:	Dec 9 10:00:56 galassia kernel: [ 598.327734] New task spawned: old: (tgid 7236, tid 7236), new (tgid: 7236, tid: 7299).Dec 9 10:00:56 galassia kernel: [ 599.751178] New task spawned: old: (tgid 7303, tid 7303), new (tgid: 7303, tid: 7304).Dec 9 10:00:56 galassia kernel: [ 599.751559] New task spawned: old: (tgid 7303, tid 7303), new (tgid: 7303, tid: 7305).Dec 9 10:00:56 galassia kernel: [ 599.753025] New task spawned: old: (tgid 7303, tid 7304), new (tgid: 7303, tid: 7306).Dec 9 10:00:56 galassia kernel: [ 599.889546] New task spawned: old: (tgid 7307, tid 7307), new (tgid: 7307, tid: 7308).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	5.003948665656089
Encrypted:	false
SSDEEP:	24:V3PDF0bOPqVRj6DpAIHq4PNUwAIRc2CAIRca7cqHnXP/cJ149AIucAGAIk+sDz:V3ZvP8RCvnPNJ62s68d33AStAYkFDz
MD5:	07F83DD83E483F21CCEF1B59ABA386BB
SHA1:	28343468353CA7E8C133E0CBDD50851D3C2AC02C
SHA-256:	95F1F3107362F8B7E76E0F5BBC2B05DF2200C9C1030F09BA6839C1BD6B98B94A
SHA-512:	5B649CBA4603339C462A1C5829DD3D4A43BB468AC014396CAAB9791DCCC45F92EA466DB8E4A5FD44BA210ACE8375807B8423F9C523D28EE9F3E3982F4002F644
Malicious:	false
Preview:	Dec 9 10:00:55 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 9 10:00:55 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 9 10:00:56 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 8..Dec 9 10:00:56 galassia systemd[1]: Stopped System Logging Service..Dec 9 10:00:56 galassia systemd[1]: Starting System Logging Service....Dec 9 10:00:56 galassia systemd[1]: Started System Logging Service..Dec 9 10:00:56 galassia kernel: [ 598.327734] New task spawned: old: (tgid 7236, tid 7236), new (tgid: 7236, tid: 7299).Dec 9 10:00:56 galassia kernel: [ 599.751178] New task spawned: old: (tgid 7303, tid 7303), new (tgid: 7303, tid: 7304).Dec 9 10:00:56 galassia kernel: [ 599.751559] New task spawned: old: (tgid 7303, tid 7303), new (tgid: 7303, tid: 7305).Dec 9 10:00:56 galassia rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0].Dec 9

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:iCsXlXEWtl/Cl2sl:Y+ylqJl
MD5:	EF44BF3717B273051305269CC75F2729
SHA1:	765178E9912B64D6A723143C5BF4A3CED86D04BE
SHA-256:	7A814B315A23DBBD276F689F9D2959C28E20BFC69F4EB5E236DC9E16C0848B48
SHA-512:	E9F3B9D2849BD06F56753E1609C086B32210202486C3721EA2617E9750FCECC7F53B5496E51DC99629309DD02B083A3E8E47FB158F0E29F504EE0B80D114037B
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.................................................................................................................................................................................................................................................................................................../.Wg........................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.556596728671079
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sora.mpsl.elf
File size:	80'976 bytes
MD5:	f38da917978d88855ecf8da376ddca08
SHA1:	80875703d185d63d9c50bb769f713792b36e0f12
SHA256:	636f2bb514e461c2914afa64f05550d18579e58d0404a2f914449068f9ed6f86
SHA512:	21a4d364c11420f163d08780d868a6d067025a1ec01bf10ed64f33d02726c89971375f06aaaa1d5be12639457776d6ae0b389f3fdca14d805b473376a1cbf7d7
SSDEEP:	1536:SuSFceW8JP33UBLwYpWoPPcsVsSbBD1OVeBSFR:/SqeT3EB8M1Of
TLSH:	1783930AAF714FF7E8AEDC3749EA1B4524DC601A21997B79BA30D418F25A20F14F3875
File Content Preview:	.ELF....................`.@.4...H:......4. ...(...............@...@..4...4...............4...4E..4E.....\...........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<...'!............$9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	80456
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x12400	0x0	0x6	AX	16
.fini	PROGBITS	0x412520	0x12520	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x412580	0x12580	0xf70	0x0	0x2	A	16
.ctors	PROGBITS	0x4534f4	0x134f4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4534fc	0x134fc	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x453510	0x13510	0x190	0x0	0x3	WA	16
.got	PROGBITS	0x4536a0	0x136a0	0x350	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4539f0	0x139f0	0x24	0x0	0x10000003	WAp	4
.bss	NOBITS	0x453a20	0x139f0	0x430	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x666	0x139f0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x139f0	0x57	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x134f0	0x134f0	5.5790	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x134f4	0x4534f4	0x4534f4	0x4fc	0x95c	3.4471	0x6	RW	0x10000	.ctors .dtors .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 16:58:19.135062933 CET	192.168.2.23	1.1.1.1	0xa913	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 16:58:19.135062933 CET	192.168.2.23	1.1.1.1	0xe59	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 16:58:19.823920965 CET	192.168.2.23	1.1.1.1	0x8f33	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 16:59:39.020497084 CET	192.168.2.23	1.1.1.1	0x820e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 16:59:39.020549059 CET	192.168.2.23	1.1.1.1	0x60eb	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 16:59:50.170181036 CET	192.168.2.23	1.1.1.1	0x5150	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 16:59:57.063574076 CET	192.168.2.23	1.1.1.1	0x96ff	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:03.305396080 CET	192.168.2.23	1.1.1.1	0xa6f8	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:17.357273102 CET	192.168.2.23	1.1.1.1	0x6c62	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:19.515033960 CET	192.168.2.23	1.1.1.1	0xbfe2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:27.573025942 CET	192.168.2.23	1.1.1.1	0x1df4	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:39.997520924 CET	192.168.2.23	1.1.1.1	0xa165	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:00:39.997584105 CET	192.168.2.23	1.1.1.1	0x9970	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:42.383248091 CET	192.168.2.23	1.1.1.1	0x9b11	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 17:00:53.647608042 CET	192.168.2.23	1.1.1.1	0xc5db	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 16:58:19.367038012 CET	1.1.1.1	192.168.2.23	0xa913	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 16:58:19.367038012 CET	1.1.1.1	192.168.2.23	0xa913	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 9, 2024 16:59:39.250796080 CET	1.1.1.1	192.168.2.23	0x820e	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 16:59:39.250796080 CET	1.1.1.1	192.168.2.23	0x820e	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:00:40.232711077 CET	1.1.1.1	192.168.2.23	0xa165	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:00:40.232711077 CET	1.1.1.1	192.168.2.23	0xa165	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-09 15:58:23 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-09 15:58:24 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-09 15:58:24 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-09 15:58:25 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Mon, 09 Dec 2024 15:58:25 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	15:57:43
Start date (UTC):	09/12/2024
Path:	/tmp/sora.mpsl.elf
Arguments:	/tmp/sora.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	15:57:44
Start date (UTC):	09/12/2024
Path:	/tmp/sora.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	15:57:57
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:57:59
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:16
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:17
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:18
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:19
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:20
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:21
Start date (UTC):	09/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:58:22
Start date (UTC):	09/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:58:23
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:24
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sora.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6475/oom_score_adj

/proc/6858/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75419qMN4gZ

/run/systemd/journal/streams/.#9:75684ti22jY

/run/systemd/journal/streams/.#9:757271ATQv0

/run/systemd/journal/streams/.#9:75728jjvMq1

/run/systemd/journal/streams/.#9:76087yMcnu1

/run/systemd/journal/streams/.#9:768992EkoX1

/run/systemd/journal/streams/.#9:76900FxEd01

/run/systemd/journal/streams/.#9:77027ApjL2Y

/run/systemd/journal/streams/.#9:77057riKsiY

/run/systemd/journal/streams/.#9:77436ks7baZ

/run/systemd/journal/streams/.#9:77536J6OZm1

/run/systemd/journal/streams/.#9:77636KS8YA2

/run/systemd/journal/streams/.#9:77976SARBH2

/run/systemd/journal/streams/.#9:78019z3NejZ

/run/systemd/journal/streams/.#9:78119yYFvm2

/run/systemd/journal/streams/.#9:78122VTmpu0

/run/systemd/journal/streams/.#9:781672R6Ux2

/run/systemd/journal/streams/.#9:78168GJmdYY

Linux Analysis Report
sora.mpsl.elf

Start time (UTC):	15:58:35
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:58:36
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:58:38
Start date (UTC):	09/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	15:58:39
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:59:00
Start date (UTC):	09/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	15:59:36
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:59:38
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:59:39
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:59:40
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:59:41
Start date (UTC):	09/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c