Edit tour

Linux Analysis Report
Aqua.x86_64.elf

Overview

General Information

Sample name:	Aqua.x86_64.elf
Analysis ID:	1580693
MD5:	a3a91d4d7b1a2a5ae8220ca1b8cc836b
SHA1:	76a2fff69bde33fb736b5c36e6ee5248f434cacb
SHA256:	21130be7fd8faaaeef35b1d0f92cb742b676a4b4764713deb9adb999c59b15bc
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580693
Start date and time:	2024-12-25 17:32:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.x86_64.elf
Detection:	MAL
Classification:	mal80.spre.troj.evad.linELF@0/209@229/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: 45.148.10.84

Runtime Messages

Command:	/tmp/Aqua.x86_64.elf
PID:	5430
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.x86_64.elf (PID: 5430, Parent: 5355, MD5: a3a91d4d7b1a2a5ae8220ca1b8cc836b) Arguments: /tmp/Aqua.x86_64.elf

Aqua.x86_64.elf New Fork (PID: 5431, Parent: 5430)

Aqua.x86_64.elf New Fork (PID: 5432, Parent: 5431)

gnome-session-binary New Fork (PID: 5433, Parent: 1588)

sh (PID: 5433, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5433, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5438, Parent: 1)

systemd-hostnamed (PID: 5438, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 5586, Parent: 1400)

Default (PID: 5586, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5590, Parent: 1400)

Default (PID: 5590, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5603, Parent: 1400)

Default (PID: 5603, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5604, Parent: 2935)

pulseaudio (PID: 5604, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5605, Parent: 1)

dbus-daemon (PID: 5605, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5606, Parent: 1)

rsyslogd (PID: 5606, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5610, Parent: 3122)

fusermount (PID: 5610, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5618, Parent: 1)

rtkit-daemon (PID: 5618, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5621, Parent: 1)

systemd-logind (PID: 5621, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5680, Parent: 1)

polkitd (PID: 5680, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5684, Parent: 1)

dbus-daemon (PID: 5684, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5685, Parent: 1)

rsyslogd (PID: 5685, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5686, Parent: 1)

gpu-manager (PID: 5686, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5687, Parent: 5686)

sh (PID: 5687, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5688, Parent: 5687)

grep (PID: 5688, Parent: 5687, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5692, Parent: 5686)

sh (PID: 5692, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5693, Parent: 5692)

grep (PID: 5693, Parent: 5692, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5694, Parent: 5686)

sh (PID: 5694, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5695, Parent: 5694)

grep (PID: 5695, Parent: 5694, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5696, Parent: 5686)

sh (PID: 5696, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5697, Parent: 5696)

grep (PID: 5697, Parent: 5696, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5698, Parent: 5686)

sh (PID: 5698, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5699, Parent: 5698)

grep (PID: 5699, Parent: 5698, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5701, Parent: 5686)

sh (PID: 5701, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5702, Parent: 5701)

grep (PID: 5702, Parent: 5701, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5705, Parent: 5686)

sh (PID: 5705, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5706, Parent: 5705)

grep (PID: 5706, Parent: 5705, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5707, Parent: 5686)

sh (PID: 5707, Parent: 5686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5708, Parent: 5707)

grep (PID: 5708, Parent: 5707, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5700, Parent: 1)

agetty (PID: 5700, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5709, Parent: 1)

generate-config (PID: 5709, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5710, Parent: 5709)

pkill (PID: 5710, Parent: 5709, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5711, Parent: 1)

gdm-wait-for-drm (PID: 5711, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5734, Parent: 1)

rsyslogd (PID: 5734, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5738, Parent: 1)

journalctl (PID: 5738, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5739, Parent: 1)

systemd-journald (PID: 5739, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5744, Parent: 1)

systemd-logind (PID: 5744, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5801, Parent: 1)

agetty (PID: 5801, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5802, Parent: 1)

systemd-journald (PID: 5802, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5803, Parent: 1)

rsyslogd (PID: 5803, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5804, Parent: 1)

dbus-daemon (PID: 5804, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5807, Parent: 1)

systemd-logind (PID: 5807, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5864, Parent: 1)

gpu-manager (PID: 5864, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5868, Parent: 5864)

sh (PID: 5868, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5869, Parent: 5868)

grep (PID: 5869, Parent: 5868, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5870, Parent: 5864)

sh (PID: 5870, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5871, Parent: 5870)

grep (PID: 5871, Parent: 5870, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5872, Parent: 5864)

sh (PID: 5872, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5873, Parent: 5872)

grep (PID: 5873, Parent: 5872, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5874, Parent: 5864)

sh (PID: 5874, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5875, Parent: 5874)

grep (PID: 5875, Parent: 5874, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5876, Parent: 5864)

sh (PID: 5876, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5877, Parent: 5876)

grep (PID: 5877, Parent: 5876, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5880, Parent: 5864)

sh (PID: 5880, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5881, Parent: 5880)

grep (PID: 5881, Parent: 5880, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5882, Parent: 5864)

sh (PID: 5882, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5883, Parent: 5882)

grep (PID: 5883, Parent: 5882, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5884, Parent: 5864)

sh (PID: 5884, Parent: 5864, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5885, Parent: 5884)

grep (PID: 5885, Parent: 5884, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5886, Parent: 1)

rsyslogd (PID: 5886, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5887, Parent: 1)

generate-config (PID: 5887, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5888, Parent: 5887)

pkill (PID: 5888, Parent: 5887, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5892, Parent: 1)

gdm-wait-for-drm (PID: 5892, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5898, Parent: 1)

rsyslogd (PID: 5898, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5902, Parent: 1)

systemd-journald (PID: 5902, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5905, Parent: 1)

systemd-logind (PID: 5905, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5962, Parent: 1)

agetty (PID: 5962, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5963, Parent: 1)

dbus-daemon (PID: 5963, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5964, Parent: 1)

gpu-manager (PID: 5964, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5967, Parent: 5964)

sh (PID: 5967, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5968, Parent: 5967)

grep (PID: 5968, Parent: 5967, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5972, Parent: 5964)

sh (PID: 5972, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5973, Parent: 5972)

grep (PID: 5973, Parent: 5972, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5974, Parent: 5964)

sh (PID: 5974, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5975, Parent: 5974)

grep (PID: 5975, Parent: 5974, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5978, Parent: 5964)

sh (PID: 5978, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5979, Parent: 5978)

grep (PID: 5979, Parent: 5978, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5980, Parent: 5964)

sh (PID: 5980, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5981, Parent: 5980)

grep (PID: 5981, Parent: 5980, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5982, Parent: 5964)

sh (PID: 5982, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5983, Parent: 5982)

grep (PID: 5983, Parent: 5982, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5984, Parent: 5964)

sh (PID: 5984, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5985, Parent: 5984)

grep (PID: 5985, Parent: 5984, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5986, Parent: 5964)

sh (PID: 5986, Parent: 5964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5987, Parent: 5986)

grep (PID: 5987, Parent: 5986, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5965, Parent: 1)

rsyslogd (PID: 5965, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5966, Parent: 1)

dbus-daemon (PID: 5966, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5988, Parent: 1)

generate-config (PID: 5988, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5989, Parent: 5988)

pkill (PID: 5989, Parent: 5988, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5990, Parent: 1)

gdm-wait-for-drm (PID: 5990, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5994, Parent: 1)

rsyslogd (PID: 5994, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5995, Parent: 1)

dbus-daemon (PID: 5995, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5999, Parent: 1)

systemd-journald (PID: 5999, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6002, Parent: 1)

systemd-logind (PID: 6002, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6061, Parent: 1)

agetty (PID: 6061, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6062, Parent: 1)

dbus-daemon (PID: 6062, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6063, Parent: 1)

rsyslogd (PID: 6063, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6067, Parent: 1)

gpu-manager (PID: 6067, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6068, Parent: 6067)

sh (PID: 6068, Parent: 6067, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6069, Parent: 6068)

grep (PID: 6069, Parent: 6068, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6070, Parent: 1)

dbus-daemon (PID: 6070, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6071, Parent: 1)

rsyslogd (PID: 6071, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6072, Parent: 1)

generate-config (PID: 6072, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6073, Parent: 6072)

pkill (PID: 6073, Parent: 6072, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6077, Parent: 1)

gdm-wait-for-drm (PID: 6077, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6083, Parent: 1)

rsyslogd (PID: 6083, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6084, Parent: 1)

systemd-journald (PID: 6084, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6087, Parent: 1)

systemd-logind (PID: 6087, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6144, Parent: 1)

agetty (PID: 6144, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6145, Parent: 1)

dbus-daemon (PID: 6145, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6146, Parent: 1)

rsyslogd (PID: 6146, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6150, Parent: 1)

gpu-manager (PID: 6150, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6151, Parent: 6150)

sh (PID: 6151, Parent: 6150, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6153, Parent: 6151)

grep (PID: 6153, Parent: 6151, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6154, Parent: 6150)

systemd New Fork (PID: 6152, Parent: 1)

dbus-daemon (PID: 6152, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6155, Parent: 1)

rsyslogd (PID: 6155, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6156, Parent: 1)

generate-config (PID: 6156, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6157, Parent: 6156)

pkill (PID: 6157, Parent: 6156, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6163, Parent: 1)

gdm-wait-for-drm (PID: 6163, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6167, Parent: 1)

rsyslogd (PID: 6167, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6171, Parent: 1)

systemd-journald (PID: 6171, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6174, Parent: 1)

systemd-logind (PID: 6174, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6231, Parent: 1)

agetty (PID: 6231, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6232, Parent: 1)

dbus-daemon (PID: 6232, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6235, Parent: 1)

gpu-manager (PID: 6235, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6237, Parent: 6235)

sh (PID: 6237, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6238, Parent: 6237)

grep (PID: 6238, Parent: 6237, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6239, Parent: 6235)

sh (PID: 6239, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6240, Parent: 6239)

grep (PID: 6240, Parent: 6239, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6244, Parent: 6235)

sh (PID: 6244, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6245, Parent: 6244)

grep (PID: 6245, Parent: 6244, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6246, Parent: 6235)

sh (PID: 6246, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6247, Parent: 6246)

grep (PID: 6247, Parent: 6246, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6248, Parent: 6235)

sh (PID: 6248, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6249, Parent: 6248)

grep (PID: 6249, Parent: 6248, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6250, Parent: 6235)

sh (PID: 6250, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6251, Parent: 6250)

grep (PID: 6251, Parent: 6250, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6252, Parent: 6235)

sh (PID: 6252, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6253, Parent: 6252)

grep (PID: 6253, Parent: 6252, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6254, Parent: 6235)

sh (PID: 6254, Parent: 6235, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6255, Parent: 6254)

grep (PID: 6255, Parent: 6254, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6236, Parent: 1)

rsyslogd (PID: 6236, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6256, Parent: 1)

generate-config (PID: 6256, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6257, Parent: 6256)

pkill (PID: 6257, Parent: 6256, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6260, Parent: 1)

gdm-wait-for-drm (PID: 6260, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6262, Parent: 1)

rsyslogd (PID: 6262, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6265, Parent: 1)

systemd-journald (PID: 6265, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6268, Parent: 1)

systemd-logind (PID: 6268, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6325, Parent: 1)

agetty (PID: 6325, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6326, Parent: 1)

dbus-daemon (PID: 6326, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6327, Parent: 1)

rsyslogd (PID: 6327, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6331, Parent: 1)

gpu-manager (PID: 6331, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6332, Parent: 6331)

sh (PID: 6332, Parent: 6331, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6334, Parent: 6332)

grep (PID: 6334, Parent: 6332, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6333, Parent: 1)

dbus-daemon (PID: 6333, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6335, Parent: 1)

rsyslogd (PID: 6335, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6336, Parent: 1)

generate-config (PID: 6336, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6337, Parent: 6336)

pkill (PID: 6337, Parent: 6336, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6343, Parent: 1)

gdm-wait-for-drm (PID: 6343, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6347, Parent: 1)

rsyslogd (PID: 6347, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6352, Parent: 2935)

dbus-daemon (PID: 6352, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6353, Parent: 2935)

pulseaudio (PID: 6353, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6354, Parent: 1)

dbus-daemon (PID: 6354, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6355, Parent: 1)

rtkit-daemon (PID: 6355, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6358, Parent: 1)

systemd-logind (PID: 6358, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6417, Parent: 1)

polkitd (PID: 6417, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6420, Parent: 1)

systemd-journald (PID: 6420, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6422, Parent: 1)

agetty (PID: 6422, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6425, Parent: 1)

systemd-logind (PID: 6425, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6482, Parent: 1)

gpu-manager (PID: 6482, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6483, Parent: 6482)

sh (PID: 6483, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6484, Parent: 6483)

grep (PID: 6484, Parent: 6483, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6487, Parent: 6482)

sh (PID: 6487, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6488, Parent: 6487)

grep (PID: 6488, Parent: 6487, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6494, Parent: 6482)

sh (PID: 6494, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6495, Parent: 6494)

grep (PID: 6495, Parent: 6494, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6497, Parent: 6482)

sh (PID: 6497, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6498, Parent: 6497)

grep (PID: 6498, Parent: 6497, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6499, Parent: 6482)

sh (PID: 6499, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6500, Parent: 6499)

grep (PID: 6500, Parent: 6499, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6501, Parent: 6482)

sh (PID: 6501, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6502, Parent: 6501)

grep (PID: 6502, Parent: 6501, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6503, Parent: 6482)

sh (PID: 6503, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6504, Parent: 6503)

grep (PID: 6504, Parent: 6503, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6505, Parent: 6482)

sh (PID: 6505, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6506, Parent: 6505)

grep (PID: 6506, Parent: 6505, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6485, Parent: 1)

rsyslogd (PID: 6485, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6486, Parent: 2935)

pulseaudio (PID: 6486, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6496, Parent: 1)

dbus-daemon (PID: 6496, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6507, Parent: 1)

rtkit-daemon (PID: 6507, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6510, Parent: 1)

systemd-logind (PID: 6510, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6569, Parent: 1)

polkitd (PID: 6569, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6573, Parent: 1)

generate-config (PID: 6573, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6574, Parent: 6573)

pkill (PID: 6574, Parent: 6573, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6578, Parent: 1)

gdm-wait-for-drm (PID: 6578, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6580, Parent: 2935)

dbus-daemon (PID: 6580, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6582, Parent: 1)

rsyslogd (PID: 6582, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6583, Parent: 1)

dbus-daemon (PID: 6583, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6587, Parent: 2935)

pulseaudio (PID: 6587, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6590, Parent: 1)

systemd-journald (PID: 6590, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6593, Parent: 1)

systemd-logind (PID: 6593, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6650, Parent: 1)

agetty (PID: 6650, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6651, Parent: 1)

dbus-daemon (PID: 6651, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6652, Parent: 1)

rsyslogd (PID: 6652, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6656, Parent: 1)

gpu-manager (PID: 6656, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6657, Parent: 6656)

sh (PID: 6657, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6658, Parent: 6657)

grep (PID: 6658, Parent: 6657, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6660, Parent: 6656)

sh (PID: 6660, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6661, Parent: 6660)

grep (PID: 6661, Parent: 6660, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6662, Parent: 6656)

sh (PID: 6662, Parent: 6656, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

systemd New Fork (PID: 6659, Parent: 1)

dbus-daemon (PID: 6659, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6663, Parent: 1)

rsyslogd (PID: 6663, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6664, Parent: 1)

generate-config (PID: 6664, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6665, Parent: 6664)

pkill (PID: 6665, Parent: 6664, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6671, Parent: 1)

gdm-wait-for-drm (PID: 6671, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6675, Parent: 1)

rsyslogd (PID: 6675, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6679, Parent: 1)

systemd-journald (PID: 6679, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6682, Parent: 1)

systemd-logind (PID: 6682, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6739, Parent: 1)

agetty (PID: 6739, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6740, Parent: 1)

dbus-daemon (PID: 6740, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6741, Parent: 1)

gpu-manager (PID: 6741, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6744, Parent: 6741)

sh (PID: 6744, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6745, Parent: 6744)

grep (PID: 6745, Parent: 6744, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6746, Parent: 6741)

sh (PID: 6746, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6747, Parent: 6746)

grep (PID: 6747, Parent: 6746, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6751, Parent: 6741)

sh (PID: 6751, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6752, Parent: 6751)

grep (PID: 6752, Parent: 6751, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6755, Parent: 6741)

sh (PID: 6755, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6756, Parent: 6755)

grep (PID: 6756, Parent: 6755, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6757, Parent: 6741)

sh (PID: 6757, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6758, Parent: 6757)

grep (PID: 6758, Parent: 6757, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6759, Parent: 6741)

sh (PID: 6759, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6760, Parent: 6759)

grep (PID: 6760, Parent: 6759, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6761, Parent: 6741)

sh (PID: 6761, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6762, Parent: 6761)

grep (PID: 6762, Parent: 6761, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6763, Parent: 6741)

sh (PID: 6763, Parent: 6741, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6764, Parent: 6763)

grep (PID: 6764, Parent: 6763, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6742, Parent: 1)

dbus-daemon (PID: 6742, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6743, Parent: 1)

rsyslogd (PID: 6743, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6765, Parent: 1)

generate-config (PID: 6765, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6766, Parent: 6765)

pkill (PID: 6766, Parent: 6765, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6767, Parent: 1)

gdm-wait-for-drm (PID: 6767, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6771, Parent: 1)

rsyslogd (PID: 6771, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6775, Parent: 1)

systemd-journald (PID: 6775, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6778, Parent: 1)

systemd-logind (PID: 6778, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6835, Parent: 1)

agetty (PID: 6835, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6836, Parent: 1)

dbus-daemon (PID: 6836, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6839, Parent: 1)

dbus-daemon (PID: 6839, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6840, Parent: 1)

gpu-manager (PID: 6840, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6842, Parent: 6840)

sh (PID: 6842, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6843, Parent: 6842)

grep (PID: 6843, Parent: 6842, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6847, Parent: 6840)

sh (PID: 6847, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6848, Parent: 6847)

grep (PID: 6848, Parent: 6847, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6849, Parent: 6840)

sh (PID: 6849, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6850, Parent: 6849)

grep (PID: 6850, Parent: 6849, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6851, Parent: 6840)

sh (PID: 6851, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6852, Parent: 6851)

grep (PID: 6852, Parent: 6851, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6853, Parent: 6840)

sh (PID: 6853, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6854, Parent: 6853)

grep (PID: 6854, Parent: 6853, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6855, Parent: 6840)

sh (PID: 6855, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6856, Parent: 6855)

grep (PID: 6856, Parent: 6855, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6857, Parent: 6840)

sh (PID: 6857, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6858, Parent: 6857)

grep (PID: 6858, Parent: 6857, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6859, Parent: 6840)

sh (PID: 6859, Parent: 6840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6860, Parent: 6859)

grep (PID: 6860, Parent: 6859, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6841, Parent: 1)

rsyslogd (PID: 6841, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6863, Parent: 1)

generate-config (PID: 6863, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6864, Parent: 6863)

pkill (PID: 6864, Parent: 6863, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6865, Parent: 1)

gdm-wait-for-drm (PID: 6865, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6869, Parent: 1)

systemd-journald (PID: 6869, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6870, Parent: 1)

rsyslogd (PID: 6870, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6871, Parent: 1)

agetty (PID: 6871, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6874, Parent: 1)

systemd-logind (PID: 6874, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6934, Parent: 1)

rsyslogd (PID: 6934, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6935, Parent: 1)

dbus-daemon (PID: 6935, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6939, Parent: 1)

gpu-manager (PID: 6939, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6940, Parent: 6939)

sh (PID: 6940, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6941, Parent: 6940)

grep (PID: 6941, Parent: 6940, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6942, Parent: 6939)

sh (PID: 6942, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6943, Parent: 6942)

grep (PID: 6943, Parent: 6942, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6944, Parent: 6939)

sh (PID: 6944, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6945, Parent: 6944)

grep (PID: 6945, Parent: 6944, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6946, Parent: 6939)

sh (PID: 6946, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6947, Parent: 6946)

grep (PID: 6947, Parent: 6946, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6948, Parent: 6939)

sh (PID: 6948, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6949, Parent: 6948)

grep (PID: 6949, Parent: 6948, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6950, Parent: 6939)

sh (PID: 6950, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6951, Parent: 6950)

grep (PID: 6951, Parent: 6950, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6952, Parent: 6939)

sh (PID: 6952, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6953, Parent: 6952)

grep (PID: 6953, Parent: 6952, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6954, Parent: 6939)

sh (PID: 6954, Parent: 6939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6955, Parent: 6954)

grep (PID: 6955, Parent: 6954, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6956, Parent: 1)

generate-config (PID: 6956, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6957, Parent: 6956)

pkill (PID: 6957, Parent: 6956, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6960, Parent: 1)

gdm-wait-for-drm (PID: 6960, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xa084:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa873:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x740e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xc40c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xe2ba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa433:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Aqua.x86_64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa6fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Aqua.x86_64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
Aqua.x86_64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
Aqua.x86_64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4592:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xa084:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa873:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x740e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xc40c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xe2ba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa433:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa6fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
5430.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4592:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 4 entries

String: EOF/proc//proc/%s/cmdlinerwgetcurlftpechokillbashrebootshutdownhaltpoweroff/fdsocket/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: global traffic

TCP traffic: 192.168.2.13:44732 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5606)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5685)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5734)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5803)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5898)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5965)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5994)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6063)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6071)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6146)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6155)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6167)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6236)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6327)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6335)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6347)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6485)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6582)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6652)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6663)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6675)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6743)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6771)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6841)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6870)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6934)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 5739)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6084)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6171)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6265)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6420)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6590)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6679)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6775)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6869)	Socket: unknown address family

Source: unknown

DNS traffic detected: query: 45.148.10.84 replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic

DNS traffic detected: DNS query: 45.148.10.84

Source: syslog.463.dr

String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5433, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5414, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5605, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5606, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5684, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5685, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5700, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5272, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5621, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5733, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5744, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5803, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5804, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5864, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5801, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5802, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5807, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5892, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5897, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5898, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5963, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5962, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5965, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5966, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5902, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5905, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5993, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5994, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5995, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5999, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6002, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6077, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6082, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6083, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6145, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6152, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6155, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6084, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6087, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6163, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6236, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6171, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6174, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6327, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6335, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6422, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6485, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6486, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6580, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6420, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6587, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6656, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6590, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6671, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6674, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6675, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6679, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6682, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6771, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6836, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6835, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6839, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6841, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6775, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6866, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5433, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5414, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5605, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5606, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5684, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5685, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5700, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5272, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5621, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5733, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5734, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5739, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5744, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5803, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5804, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5864, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5801, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5886, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5802, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5807, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5892, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5897, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5898, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5963, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5962, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5965, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5966, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5902, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5905, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5990, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5993, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5994, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5995, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6067, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 5999, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6002, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6077, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6082, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6083, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6145, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6152, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6155, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6084, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6087, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6163, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6236, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6171, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6174, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6326, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6327, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6335, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6422, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6485, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6486, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6580, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6420, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6587, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6656, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6590, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6593, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6671, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6674, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6675, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6679, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6682, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6767, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6771, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6836, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6835, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6839, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6841, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6775, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6778, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6865, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6866, result: successful	Jump to behavior
Source: /tmp/Aqua.x86_64.elf (PID: 5432)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior

Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: Aqua.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 5430.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.spre.troj.evad.linELF@0/209@229/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5605)	File: /proc/5605/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5610)	File: /proc/5610/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5684)	File: /proc/5684/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5804)	File: /proc/5804/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5963)	File: /proc/5963/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5966)	File: /proc/5966/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5995)	File: /proc/5995/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6062)	File: /proc/6062/mounts
Source: /usr/bin/dbus-daemon (PID: 6070)	File: /proc/6070/mounts
Source: /usr/bin/dbus-daemon (PID: 6145)	File: /proc/6145/mounts
Source: /usr/bin/dbus-daemon (PID: 6152)	File: /proc/6152/mounts
Source: /usr/bin/dbus-daemon (PID: 6232)	File: /proc/6232/mounts
Source: /usr/bin/dbus-daemon (PID: 6326)	File: /proc/6326/mounts
Source: /usr/bin/dbus-daemon (PID: 6333)	File: /proc/6333/mounts
Source: /usr/bin/dbus-daemon (PID: 6352)	File: /proc/6352/mounts
Source: /usr/bin/dbus-daemon (PID: 6354)	File: /proc/6354/mounts
Source: /usr/bin/dbus-daemon (PID: 6496)	File: /proc/6496/mounts
Source: /usr/bin/dbus-daemon (PID: 6580)	File: /proc/6580/mounts
Source: /usr/bin/dbus-daemon (PID: 6583)	File: /proc/6583/mounts
Source: /usr/bin/dbus-daemon (PID: 6651)	File: /proc/6651/mounts
Source: /usr/bin/dbus-daemon (PID: 6659)	File: /proc/6659/mounts
Source: /usr/bin/dbus-daemon (PID: 6740)	File: /proc/6740/mounts
Source: /usr/bin/dbus-daemon (PID: 6742)	File: /proc/6742/mounts
Source: /usr/bin/dbus-daemon (PID: 6836)	File: /proc/6836/mounts
Source: /usr/bin/dbus-daemon (PID: 6839)	File: /proc/6839/mounts
Source: /usr/bin/dbus-daemon (PID: 6935)	File: /proc/6935/mounts

Source: /usr/libexec/gsd-rfkill (PID: 5433)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5433)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5438)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5621)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5621)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5621)	File: /run/systemd/seats/.#seat0k6nTRg	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5680)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65094rZvrDV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65095yiflcX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65096DMU6zV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65097I0E5tV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65098MCMO7W	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65099v10FxT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	File: /run/systemd/journal/streams/.#9:65111qcSkxW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5807)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5807)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5807)	File: /run/systemd/seats/.#seat0US3HBg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:66622LWh70s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:66624293S4t	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:666251dvkhv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:6662661tezv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:66634qTX58t	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:66729zemMWs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	File: /run/systemd/journal/streams/.#9:67591rSfH5u	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5905)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5905)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5905)	File: /run/systemd/seats/.#seat0gPJ8IG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:68214V3AyoM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:68215pqCQSP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:68216U0aqnQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:68222JirjWM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:68228FQQuLQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	File: /run/systemd/journal/streams/.#9:67209S3W50P	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6002)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6002)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6002)	File: /run/systemd/seats/.#seat07HrFm1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:69762cgK8Ye
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:697634MWdJd
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:697648EXiEe
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:69770uepxEf
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:69782Z4ChEd
Source: /lib/systemd/systemd-journald (PID: 6084)	File: /run/systemd/journal/streams/.#9:697832wlT5d
Source: /lib/systemd/systemd-logind (PID: 6087)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6087)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6087)	File: /run/systemd/seats/.#seat0bNcjVs
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:695141VHQTO
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:69515AX7pOM
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:69516xP6NgP
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:6959696pJeO
Source: /lib/systemd/systemd-journald (PID: 6171)	File: /run/systemd/journal/streams/.#9:70695FQ4rNP
Source: /lib/systemd/systemd-logind (PID: 6174)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6174)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6174)	File: /run/systemd/seats/.#seat0EGiCS2
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:70542jeUlNV
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:705431OYezT
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:70550Em7eIW
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:70551UniHkV
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:70563kcnEuT
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:70564giMLEU
Source: /lib/systemd/systemd-logind (PID: 6268)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6268)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6268)	File: /run/systemd/seats/.#seat0eSJBn8
Source: /usr/lib/policykit-1/polkitd (PID: 6417)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72653Dy4wcE
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72655HkLEuD
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72656Bye0pF
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72658fXMHAC
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72659w0DE2C
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72663sYNwhF
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72665afxofF
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72666ZH2z8F
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72667a58fVE
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72675E5KDtC
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72676PX8Z6D
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72681xf31HC
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72682Jjh1EG
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72684vEsgdE
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:72692zmWIZF
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:73734wIMTgF
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:73850qfap0F
Source: /lib/systemd/systemd-journald (PID: 6420)	File: /run/systemd/journal/streams/.#9:73870l4HkFC
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/seats/.#seat0hFtUy0
Source: /lib/systemd/systemd-logind (PID: 6510)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6510)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6510)	File: /run/systemd/seats/.#seat0NkaQKr
Source: /usr/lib/policykit-1/polkitd (PID: 6569)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:745328JGojx
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:74533kb5Imv
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:74534gAkvru
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:74545lGFc4s
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:74552BShl7s
Source: /lib/systemd/systemd-journald (PID: 6590)	File: /run/systemd/journal/streams/.#9:74553OKLxlv
Source: /lib/systemd/systemd-logind (PID: 6593)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6593)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6593)	File: /run/systemd/seats/.#seat0JgCZiJ
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76043xeCuGe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76044EJPqPe
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76046joOX7d
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76047X3N7Dg
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76054WHu6We
Source: /lib/systemd/systemd-journald (PID: 6679)	File: /run/systemd/journal/streams/.#9:76079BuFj3e
Source: /lib/systemd/systemd-logind (PID: 6682)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6682)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6682)	File: /run/systemd/seats/.#seat0mgYsns
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:76539xmt0zw
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:76540W44D6u
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:765414WKdMu
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:76549AfAQOs
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:765507mAYou
Source: /lib/systemd/systemd-journald (PID: 6775)	File: /run/systemd/journal/streams/.#9:76568gyJggv
Source: /lib/systemd/systemd-logind (PID: 6778)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6778)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6778)	File: /run/systemd/seats/.#seat08oXQWI
Source: /lib/systemd/systemd-journald (PID: 6869)	File: /run/systemd/journal/streams/.#9:77619TnxQdC
Source: /lib/systemd/systemd-journald (PID: 6869)	File: /run/systemd/journal/streams/.#9:77620wLjoGA
Source: /lib/systemd/systemd-journald (PID: 6869)	File: /run/systemd/journal/streams/.#9:77627BnKTgD
Source: /lib/systemd/systemd-journald (PID: 6869)	File: /run/systemd/journal/streams/.#9:77633AIFdBA
Source: /lib/systemd/systemd-journald (PID: 6869)	File: /run/systemd/journal/streams/.#9:77640nZGcnC
Source: /lib/systemd/systemd-logind (PID: 6874)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6874)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6874)	File: /run/systemd/seats/.#seat0hPJzFZ

Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/238/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/238/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/239/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/239/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/3095/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/3095/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/241/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/241/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/246/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/126/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/5/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/5/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/247/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/247/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/127/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/127/cmdline
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/6/status
Source: /usr/bin/pkill (PID: 6157)	File opened: /proc/6/cmdline

Source: /usr/bin/gpu-manager (PID: 5687)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5692)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5694)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5696)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5698)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5701)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5705)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5707)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5868)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5870)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5872)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5874)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5876)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5880)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5882)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5884)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5967)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5972)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5974)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5978)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5980)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5982)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5984)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5986)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6068)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6151)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6237)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6239)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6244)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6246)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6248)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6250)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6252)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6254)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6332)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6483)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6487)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6494)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6497)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6499)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6501)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6503)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6505)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6657)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6660)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6662)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6744)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6746)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6751)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6755)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6757)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6759)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6761)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6763)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6842)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6847)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6849)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6851)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6853)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6855)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6857)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6859)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6940)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6942)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6944)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6946)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6948)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6950)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6952)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6954)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /bin/sh (PID: 5688)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5693)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5695)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5697)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5699)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5702)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5706)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5708)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5869)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5881)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5883)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5885)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5968)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5973)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5975)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5979)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5981)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5983)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5985)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5987)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6069)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6153)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6238)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6240)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6245)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6247)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6249)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6251)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6253)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6255)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6334)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6484)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6488)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6495)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6498)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6500)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6502)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6504)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6506)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6658)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6661)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6745)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6747)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6752)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6756)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6758)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6760)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6762)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6764)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6843)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6848)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6850)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6852)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6854)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6856)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6858)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6860)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6941)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6943)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6945)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6947)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6949)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6951)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6953)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6955)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Source: /usr/share/gdm/generate-config (PID: 5710)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5888)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5989)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6073)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6157)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6257)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6337)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6574)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6665)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6766)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6864)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6957)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd-journald (PID: 5739)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6084)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6171)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6265)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6420)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6590)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6679)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6775)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6869)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 5700)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5801)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 5962)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6061)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6144)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6231)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6325)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6422)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6650)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6739)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6835)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6871)	Reads version info: /etc/issue

Source: /usr/sbin/rsyslogd (PID: 5606)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5685)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5685)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5686)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5734)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5803)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5886)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5886)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5898)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5964)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5965)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5965)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5994)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6063)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6071)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6071)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6146)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6155)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6155)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6167)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6235)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6236)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6236)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6327)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6335)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6335)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6347)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6482)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6485)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6485)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6582)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6652)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6663)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6663)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6675)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6741)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6743)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6743)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6771)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6840)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6841)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6841)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6870)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6934)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6934)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6939)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.x86_64.elf (PID: 5431)

File: /tmp/Aqua.x86_64.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5686)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5864)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5964)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6067)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6150)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6235)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6331)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6482)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6656)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6741)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6840)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6939)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pkill (PID: 5710)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5989)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6073)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6157)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6257)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6337)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6486)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6574)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6665)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6766)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6864)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6957)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 5438)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5606)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5685)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5686)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5700)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5734)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5739)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5801)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5802)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5803)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5864)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5886)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5898)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5902)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5962)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5964)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5965)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5994)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5999)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6061)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6063)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6071)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6084)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6144)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6146)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6155)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6167)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6171)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6231)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6235)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6236)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6262)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6265)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6325)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6327)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6335)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6347)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6420)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6422)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6482)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6485)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6486)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6582)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6590)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6650)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6652)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6663)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6675)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6679)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6739)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6741)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6743)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6771)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6775)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6835)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6840)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6841)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6869)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6870)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6871)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6934)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6939)	Queries kernel information via 'uname':

Source: kern.log.43.dr	Binary or memory string: Dec 25 10:33:03 galassia kernel: [ 115.834024] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: kern.log.43.dr	Binary or memory string: Dec 25 10:33:03 galassia kernel: [ 115.834048] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.x86_64.elf	52%	Virustotal		Browse
Aqua.x86_64.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.x86_64.elf	100%	Avira	EXP/ELF.Mirai.W
Aqua.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
45.148.10.84	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.463.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.190.156.145	ngwa5.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	ngwa5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wiewa64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/systemd/journal/streams/.#9:65094rZvrDV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.507110016590155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8AjRG1WDv3hTjs7LH:SbFuFyLVIg1BG+f+M8QG1WTRTji4s
MD5:	0B762501315C3088E5B019C542FA47EA
SHA1:	8724FE69930639CA1718F92DFEBB733B5DEBD804
SHA-256:	2BBE326BFD853C76A7E2FE5BED216F36374DEB7CB2DB95DFB9B177A7D99747B2
SHA-512:	9BFC738388E32C492A0FFFE358EF1A27EFE88EE2736CBB456C97B394885FDD9CEEE17068C3C5143310FE58034641FB422813A57342C54F2FFA4E1348DBD3A30F
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ed0978cafff44788838d27ce5d0d11e.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:65095yiflcX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.45098026535805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrBHQVnRVAUB2dcNNv:SbFuFyLVIg1BG+f+MNQVid7jZcHcljX+
MD5:	E486DADE365FCA4053DACCD94E1A8475
SHA1:	778EED311FCE752FBA1D233A6F5B63A5D76DB223
SHA-256:	E69E6ED8F7410B5E08873C2A56468073F3AF7C1EA1DB5ED6E8BF7595FFFF526D
SHA-512:	D3DD0F0D3B0545B7F41F9763076B4043F56320BC7757B179B113D3323C296EBB1D3DD2D3604A75FCE8C4DB21F802DDEC71EC74A1BD866E36DA91C5E42BC6060F
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac43b2e077a140c1b169115a17de8911.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:65096DMU6zV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406176329467166
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8QXSGHXcEUZTjosQu:qgFq6g10+f+M8QCGHeDQu
MD5:	9B904F5D3A696962065D96B84874CBA5
SHA1:	6CB5277BF9B45DD49A40B86E9EF8092990C7F412
SHA-256:	416892611C7B3C25810A0C47C4067CC6F14AF7DDB1E4195B6ED7E84710699019
SHA-512:	5A510D0E473D788CB6CEF07DB856F3DFDD2D89E22B7B4652111D09C3BA36720C154365B7B0F11F717D00EDFBAE5DCE3B22F1866ACE3D7BF23F0C0A3F095CA482
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=699eb022273d4b9fa9c92be14a8a263b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:65097I0E5tV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.503297424468626
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrwUO4idT2YNlsjsig:SbFuFyLVIg1BG+f+MsZ4yP2jZcHcljX+
MD5:	C42EF08CC3FBB468348F5D925BDD3F7C
SHA1:	4B040ED0E309E8602972A2792C422125567A5B32
SHA-256:	63F064BFB0493A57CE48AFDC449ED66280F95DB10093D409F83588AAEA105724
SHA-512:	284474C44F4B914F34F6C62F998ADDADC786FE8721803604B879DF77366F6762342AE1EAB4BE9BE2964AD6CCBB8A05F27A1225770BD7C79FD27F0AD0C6889EF8
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=adc474426f7a49f08032574818849bfa.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:65098MCMO7W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.469686364801628
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+ddCvq6R3JYTjs2ALAQ:SbFuFyLVIg1BAf+M+gJR6TjNALyAZD
MD5:	35C787CC823446AAF074515C56B7C592
SHA1:	D2A5947D0E4F5536DEC8EBE90490AF71421DB357
SHA-256:	4B06C92A1D9143C07A4D7886AC3C186219AB21B45D26489B0EA5C180D97B9BF1
SHA-512:	5FD83B248F198D64B27461A346FF5F61B35522F8545924CE82913344FCB7D6539BE714316B38E8CA128B8D2AAF04D552FD66DBCF7CF0EBE305F159A97B4CF14D
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d71318012394b859f17f56de849b559.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:65099v10FxT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.402101794518191
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8HWntR6VmsdqjswkT:SbFuFyLVIg1BG+f+M8HWnj15jLkGq
MD5:	D6BB8FC482736664D1911B9471F43D30
SHA1:	04AACC6A7941B697999E02CAF1CD4FA07921D449
SHA-256:	FF94062B867A9B34480447DCFB703FD8AC60C0C29808D9FE6781C622CC8BB567
SHA-512:	836EB8FD836A5EAFC62AD97DE30E06250F003FEA00C11B71D99CBEB9F5DFBF6DB519CB22745AEF5FB08F468C68B256160C5246FCE9A5F8F170B3A59435334869
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b35724bd0e3460a82060c73a51f1a8d.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:65111qcSkxW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.454339904370867
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7NRR1EhWw0js2BbQIeT:SbFuFyLVIg1BAf+Mh31EhyjNdQIeXD
MD5:	9D2F3F19FA8EE4950708C6DA03AF8497
SHA1:	0708B73036BA7B7DBC37FD08DDC135F3EC786AF4
SHA-256:	FCD0AF59BFE24FF99F17B7552A19EFCF3B8521ACF6731FD66B528CA4CE27B7BF
SHA-512:	7C33A34B3DD5D63AEEB58B5FB5D2FE4522E1AD64026CBB24AD3F0EFC278F93AF1EEC76EB5F012D9D82A9D56F102EA4AA967D325BDB62074EE38E8882EE74186B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1575a949848049dea63ab0a52b43a31d.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:66622LWh70s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.494311458951827
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MkYRnC1G+2jZcHcljX+:qgFq6g10+f+MrRsPYmAu
MD5:	FA0AEF9F1E3ABB5CBC83CFCB5ABD26BE
SHA1:	2CEC1DDBE6E0D7E3965BB6CF3468D22EEE3402F2
SHA-256:	843A133952B56761074D3E1AE54803DC79CA9621F12F7DD22D5433608EE53952
SHA-512:	5B4FBAD2E85CF42ECE7B64AF02D843E402F9877BDF73314D227E972FED9F5D6D08655695B8CE1331F69BF1423FD4E4135EC6F1E2A64D277A9699E5867A78231B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6c96d4fe6dc4334b8a5e249ac7a2782.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:66624293S4t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.410305570879116
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyVBdnBB10Qolsjs16:SbFuFyLVIg1BG+f+MyVBB10QrjosQu
MD5:	B691F73F143CAE20F755F4CB2176FACF
SHA1:	FBFBBC802EC54F420A974EB15F0FE50E0B313B13
SHA-256:	C98D8DE63AC544DF0079A8A10487485181F4D50604E4C1F51804768F9B2A749A
SHA-512:	B6F19D62B99E3CE95E8ED0565B79C16E02AB180504D2CBF18F6576EC39A72DFFEEB1AB6FB0A439B940BC49F0B4B10B40B2F04D1FD5E5E64FD3B45942370E7CBD
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8bc7b2da4239404b89a3dd7c8459c5a2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:666251dvkhv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.434129391439883
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+McsARnGnzVQ0josQu:qgFq6g10+f+McHSrQu
MD5:	41BF79D639876B7489C19645BF882F5D
SHA1:	A657277EDBDD74204A60887611A0409EB14FB2C3
SHA-256:	703DDAA92FF22158C59C90C6ADFB40C4F7AB257F67FB4784AA05FF9374F7CD2F
SHA-512:	9C5232481D7202D23475F50BE08F9E8EDADD77D4FAD97CC9432CBE820BEC70CDFE516D339BBA3B4B37013CCEF34A9F82B7CE75E7832F67361A5DD93F19FE2D87
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a84fc2bb8fe46d2856bb810d63c90f5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:6662661tezv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.416261217426039
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsP0sGi1UpXzsjs2ALAQ:SbFuFyLVIg1BAf+MsMspUpwjNALyAZD
MD5:	6641B6B711BCA4AF8F9CC0066EC2BD52
SHA1:	04F3C1C0F9A95CD4FF0D36083A0A25A8BCB3712A
SHA-256:	5A56390BD648A21245775C6F25C1F0222C51FAA9C2CAB619B93718D80C62A6ED
SHA-512:	DBC1C79E0CE6BDD0306ABB0BBD1A033918B3E1BCFA8E24734F7A86E1388F3CD431E65855CCB64CDF284ABD21E09B4D6CC179504A7EF4858374D71F2679A512F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4f0a80edbc74d2cbc2bf23b0f248521.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:66634qTX58t

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386513484252912
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6UARG0sDYzEEvswsS:SbFuFyLVIg1BG+f+M6UArsDAtv8jLkGq
MD5:	5A765036F6D9C4E2B54D7D67CD0FF458
SHA1:	71A86D732702F946699E253F90BD2140C1CD25BE
SHA-256:	381A51DF31A4F1651D97FD19589D8FDEFE120F7DD2BEDADB696F92655455B744
SHA-512:	D6E73365B5FB5C7BAFD152AEF7D9F61FC84AAEC5BA6CA011082DB54F8A17AE43353F599F4BA2A269C1A6B846A556B6DE57D9E06A98A605E3C70862BE9886646B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=06de938be4ce40edbf3111f758ee178a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:66729zemMWs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.453558875762429
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyYtB/GQGbjNdQIeXD:qgFq6g1af+MyY//HGt2D
MD5:	41D5597275C5242E01DD23FE575CA2C8
SHA1:	6046788EA8BA661FBEFA55639D9DE1DAE549D911
SHA-256:	E0ECFF19F8A2C5178257313BC4E038ACE8A6F6D5BCA99F377D4C1A456266C2A0
SHA-512:	EE9685A2903809E47B4F7D3D0FD30D19C1B4BC62957E09372E59EA6C9DFF1BFD63D8DEB7A7B16B63C93052EC416F63F82461116A478EA0BF95CC9077230AD286
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91f8a030313941ae94bab77c68cc5c0a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:67209S3W50P

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.397881407217336
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+9abmxFcDJhvFlsj+:SbFuFyLVIg1BG+f+M+9KQFcDnF2jLkGq
MD5:	C4127202A15D1CFB4D71FC6DDE4E4D58
SHA1:	E1BCD3EB669F6297C994FB8FA7D082E78A38E13B
SHA-256:	EA838EC71D67AA0349C6C439095045DDE7BC11A48419133423CBBA568F27F476
SHA-512:	5CA234417B67577C94704DAFB19BF5F860CEFF769C40C06B0FFDDF03BD3577E06D761DAB0FC9EA40569D15B047EA175932DA99182DC6739E5A6FA5932886A3E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=452a8906a2ed4de19268a7559f15be01.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:67591rSfH5u

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.375710114556747
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpRcRmcERqCRvsZjsc:SbFuFyLVIg1BG+f+M8RAQc8josQu
MD5:	75649645B124C3B29894E0BDA0D025D7
SHA1:	A65B06971F723CEE83A51C06B5DA7C51D2C7C05D
SHA-256:	CE23D731A7EB7ECAC7F18025FF18C904F8B6B3D8AE25EB04141C4762D64ACAED
SHA-512:	773A23A57FE14374654458A016BCCE36E1F3929194E6F120D73A63A703EFE91DA748DCB87BED523AA10CF9EB4E3371FF1C59CDE9C7E6E22F791F4F85F9695528
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4e43b4d2bb94c5c9b90de908719c404.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68214V3AyoM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.498386899643826
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MAiiV8MqjZcHcljX+:qgFq6g10+f+MAlBkmAu
MD5:	47E45A8DB944720AAC37710564EDAE15
SHA1:	928704E9B04A17BFA420FD98EE687EDFF96FAAC5
SHA-256:	DEA009C306A3449139045B1B5CC2FC1DB529B05DF9A517CE651407FE996751D8
SHA-512:	F8A10F49C57FCFC0138BDB28BE4D5618A9A76B36C7D08A9D9B728927ED3AC64D47205902DAE431EF93048F2749E83F083CF7DB9456F5ECA23E9A6BA87A8E0452
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5c670f4d297493193c0d02b51985091.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:68215pqCQSP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.429035266258757
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/xDfeaeGEvswsjs16:SbFuFyLVIg1BG+f+Mt3E8josQu
MD5:	9D0F407BF947A28AA13AD3A68BA04BE9
SHA1:	0408876E66E7EFE8CBE50FA0FEE1039F5FF1AF70
SHA-256:	9DBDE0C3C2510F2331CE91F530693AF5594D90CCCACD6816EFE466141682418C
SHA-512:	31440AAF74E5F0B66BB2C8DAEFDB090677CE850352DC4925FE4C4B583BF59BEEAFAF39313962DFC6A2E5D122DC024A29AC1B03810EEB2627D0E0258D617044BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5f17a9f59c944a89ab589fc8b34d82ca.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68216U0aqnQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.387537244684926
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9f9RXzGVB1Rehz0M2:SbFuFyLVIg1BG+f+MDRXW1ywZjosQu
MD5:	DD7BD2B350F8E7D42D63E4C296789BCB
SHA1:	CF3E5D1B3196347849DC6AF361D49AC6CB7190A7
SHA-256:	D7FD538238EAA0C1E7AA8E6D42F3571EAB089C248B86F17EB0DE11D2222FFA20
SHA-512:	6FFBE15F3287DD14BDE7DD04BE354A9BA9D76CD49EAF946F1161081326A587E5A8666F733B49BFB250D97D4F1670D327D89C215907B2433EDFEECBBBEA0567C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ff5c0f48303406c80dc3ce40764b0bd.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68222JirjWM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.413019057516437
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+qs9d8caIWpATjs2ALl:SbFuFyLVIg1BAf+M+1dNs8jNALyAZD
MD5:	0B911C464EEAD90B57EEE6BA71A7D2CC
SHA1:	C7F96009ABBE9861A364D957C8F53D0646058CEA
SHA-256:	42461477F62557698D5D106A8B4BE4333866CF61A1E4AF39918A537CB1E646E4
SHA-512:	46F3ECC033FDD0CF5D6444ED93A2EB2C2E3A19A48F6685CFE3355A3466AF6958C8CE1E2CB4AD6295FE848EBE497988429154FFF892EF8A80B4C84E183B08F817
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d00a607b8fb4bc38bb9916d40e603b4.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68228FQQuLQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.454889871102084
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MoEi5veSq0jNdQIeXD:qgFq6g1af+MoV3R2D
MD5:	5194AE569BBB631C84023443DF8D02E9
SHA1:	3602B8FE82F239E5028490C6E5E5DD73C785C124
SHA-256:	FB253A00D89718FBC129E96EA57017E06CEF8E96765493ED543E7788007FC7AE
SHA-512:	ADC9E2EEA68D348DE322F57FC66C4D9221978F373D94900ADC44491CBCF3772B6C1CA0F86CF35C0133C799EE1C7D2793E1AC3BCA9EAF6CE0ED9F7BE2B0F5CF61
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b3f745c989fd4e73abbe9b4d4ebb27af.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:695141VHQTO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.471580578883684
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MDcFXKcZjZcHcljX+:qgFq6g10+f+MCxzmAu
MD5:	F10C533CD44EA266A6BF9445A0DEA84D
SHA1:	B5C8FD24B769F4CBE166D2361A8EE6D8AF657A1C
SHA-256:	A802944BE7A26AB439F7B5544942F223452F4FAEC57CBAFF712A629CFDAB9E1F
SHA-512:	EDE656143EFFDF38B4B28AA2696EC2ABB2CF1092A15DD74753E3A61A9B4DF1B16C1CF4FFCFD6CCAF2CAB42AECC76582345E0B1665D07A57C75CDBBDBF9AD6576
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f266725fec4452eaffbf2b6a2ef71cd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:69515AX7pOM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.373307698368468
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5C1Ed9VBpfIZjs1Ha:SbFuFyLVIg1BG+f+Mtd99fIZjosQu
MD5:	F27525910A2D2379E66201C3401562F3
SHA1:	1B3E95738E75CF77121AB30D9824A7D2FB741EDF
SHA-256:	7EC8EB990F6EB569D99728F66789A155E12E4B4BF9173B33A7EAEC27B8AB1310
SHA-512:	43B80F9D06FA604F09BB9E1079D4AC68006595D56DD6D421EB9AEE2FE9E07E63481700FE6232D0BC1256F098C394BFF65DB135B7C2459AF26DCA4BB535DCDFBA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3be1d8eeb3a84862a8a0d2398e98c117.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69516xP6NgP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4522983435901855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzYXWDDERF4dVdykgrqi:SbFuFyLVIg1BAf+McX/3AVuqjNALyAZD
MD5:	72E03748C2E2124CE5110855EF702338
SHA1:	63FE68527886CDB9D1BEF0FD4E5930305D32EFD8
SHA-256:	AAC3F6968791301A51BC6A041961438DB58F75AC7FABD8855B3C0D6ABE6F87F8
SHA-512:	2B67E29BB3E8F359FC2C5568719362427E3BBE0EC27676A90739A3061037D4449642E921E33CB070EBFE661C888D5FA20AE548DA905D76DE47AE699B9DE95B91
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9fa353ffa9cb4b558278032f71b5da97.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:6959696pJeO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.391818306597915
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9Df/kDNALBQzATjsV:SbFuFyLVIg1BG+f+MBKNALK8jLkGq
MD5:	4BBE91AA500A136BBBE4DF1FAD4899CB
SHA1:	D442E2D46BE6D23AE30B6CA37C11971CB051351F
SHA-256:	FEC77237C8F48A69DDAAECDAD789DB8D8B611D01BA4F699A7615F15F86339374
SHA-512:	84016B1806FCBF5645018D94083ABE03FA509F7D55CBA3FC0326866BDB3969F787662808191AED58D1D63C3E471BC407367AC7B7421126E0C8259355515BDF2E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7263af6d95dc4f808e6af562687d0eef.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:69762cgK8Ye

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.475570763240854
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzRLHEdwzDSqjsicWg:SbFuFyLVIg1BG+f+MB3DSqjZcHcljX+
MD5:	5A51F934F2D8227C6624EB1777FEE59C
SHA1:	FA4D828B91C65183874FA5032200D5A85CCBC722
SHA-256:	90101C99BB6F798556ED648B21B8D4392376E13DAF6B9517EB8EF7E44D7C5E2B
SHA-512:	36C372441B1768AB731E98012731C1B67B415F03CD6F92B6250BCBED4C4B452AC053812ADF45FE2BAF5E23E7260AA22DEF225F120123C929BB55C96656912FEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=92df389934c1408a84398af7f2cfbf0e.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:697634MWdJd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.441457169988809
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5sV7IU1YTjs1Hadme:SbFuFyLVIg1BG+f+M+NIU10josQu
MD5:	7D672F7110BB33D301AA9CD8F846105E
SHA1:	CB7346DD67BFB590D50CBB1E2E62B741328D66A2
SHA-256:	A8E67F223338F79569DE2CAD83437939612CF6A19BEFBFABFFE48B7B4C827560
SHA-512:	10AAC06B4EE4B5D11740AEAF8939ACD6929CA7638A28476E94F34E516E4141961983C1CE59C84986C34E028ABAF91EEBFFCDCD457760A84764CC6B3BDA8313DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dc12713314842249af8d6501d00bc9f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:697648EXiEe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.42802374462105
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpEYb+TAEzBQ/LhglU:SbFuFyLVIg1BG+f+MNb+TASQy2josQu
MD5:	41C2DF5F93A03366B2298AD532F560D0
SHA1:	741254B0D61ED6F39A85B7EEEBD9994F44D47DCA
SHA-256:	1925B8F6DE6423AC4BDE6B4B340A91602BD61B447CFB3C4D1A20FDDA40451257
SHA-512:	E54E51CB37416E6299CB1FBFA3A381D8F4BC063527BA6D20466FC343E659A9F2598C804626B11767CEB21D44BA89064432577D0B4A4C0A45E0EFB3B54F8A89BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c27b8c9739f746e2a86229cdddfba001.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69770uepxEf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.468901617009339
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8DAdivEuqjNALyAZD:qgFq6g1af+M8sivEuwIZD
MD5:	2AA2623049F8A24207FDB1ED767E5132
SHA1:	28613BFC03510E9C5E38734164D45EC2A7D85FD8
SHA-256:	E5E46D8D2D95D20EF716EA49C4969413782420F7D70E373845832C30179F4883
SHA-512:	03D0D5B62FDC31371B78BCD9E1E53CD089EE6A1C3009AB46468FFE0992D72A12E1E5EE841C8236390E0E59B3DA0E58D8DA2CD768C161959BAC14ED12CDCDFCF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=62d8c715e8744d608ba5259587963efc.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69782Z4ChEd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.494257200421783
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7lWmsQPHRucmxZjs2BI:SbFuFyLVIg1BAf+MCQPlmTjNdQIeXD
MD5:	1716B6389E46F72FF2AFF13360F8CD94
SHA1:	AE94F011E4BFBB49203EA8B8529E3FB75DD01B53
SHA-256:	85F376D86F5D886C0D7BC1AA90A96A0AE032B9371BD8084FE34FA9D335039815
SHA-512:	4470B140F7EA29BE993DC2BED82BB8965A3D0BA99DA25275798F74E6BF9C628ED273CA66F4057E6FF236E724267E09478DE65DB1D1BDD25C71D5E3AA63DECC9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d63bc9856fb4d35a9bc22033f791b8d.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:697832wlT5d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.425364970197373
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7QwAOEUcRmXWEmMj+:SbFuFyLVIg1BG+f+MscEUgjMjLkGq
MD5:	9AB1954A945D9FD406914B267F290AAC
SHA1:	D9D190FC279AD8B2992691D2E4030FB99842CF74
SHA-256:	E788E2DD2465D384228FE8C589AFC9040F150F3A96A940BE3D7CA5BE448540F7
SHA-512:	D2FF918370A7EA7166AEB9902B1184DF639A5F5069320FFF4A223267468316E73F1231182E5967B99A7B525690491A4E83F1EFB57C2EEF6EA193AC7137BC35B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=187dcef7a5d944a480801b92353a70f6.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:70542jeUlNV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.47900207006887
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrVJyw3rGcX0jTNrqi:SbFuFyLVIg1BG+f+MryuXjZcHcljX+
MD5:	844ADD3192E49D1E7386CA543AC7FA98
SHA1:	C635FB6CE9B82CD7BB0AD23DD6D3F09750CD9159
SHA-256:	96EA90C44B17443FB6EC2205DC40FE8A17F55BCF8FA5821A680668F08EFA4A55
SHA-512:	03E034B9FA0F0D361A8DA57448263D13FF3F3F83BC35F4140A68799C5E41251D696B863DAB56AE52B998C2A41EB5B9A0B4FDBFE19D7E300FB388C14DAA95F259
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a8215471e4374514b50dc9aab2047ec6.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:705431OYezT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.412066575596992
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9WKwaJLqU8WceZjsc:SbFuFyLVIg1BG+f+MoKJZqpW3ZjosQu
MD5:	63E5F3A1ABAF41D4EE09DD0BEE393C84
SHA1:	AF4B3C7615FE9A1B54A07A892057285FD9CBCD96
SHA-256:	1167CF0ACDFE0A45E56BDF985A26FD10DBBD22A4057C936BFB0620F67132873F
SHA-512:	641BEDBC30558EA22D7904E3641698E4133C63E63F0064FD5A7B60EEAFA5F7C8567D1DAD2EC2964D6A7C9EEEA9C6F3326E13675E3AC0721C3BE50ABF344F6B13
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=739054f5dcfb45bfaa17476101f390a7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:70550Em7eIW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.416880403724283
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpQRBNEiLiL+uqjs16:SbFuFyLVIg1BG+f+MeRtLiqTjosQu
MD5:	292938F8CB9F40BA171EECDB6D1A9E4B
SHA1:	C4A9FE80D45E1893E5BABD52A9E9C9C38785A090
SHA-256:	9B6D9A7816F7E9D34087680F3A3CE0A3EABB8B3872A4D76B34CE8C1C7DBD1E6E
SHA-512:	B9D3C1A2B79848C4D43ABF96FB20DAF899FAF07718E2F556CF9E95FAC6C72A6BA116ACA7A3BDC0808BFF7086CDC9DED610E21A2B2A297DDB6CB083059119B15F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c64246f94de74e1dbb8c4afc4ef9bf28.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:70551UniHkV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.47183457898432
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrfGDURXBTAIbRWEN2j+:SbFuFyLVIg1BAf+MzRRThW62jNALyAZD
MD5:	592C42C11988AC67FF207BC0271EE38F
SHA1:	00AA1FEEE62DD5C1AD2B94EFF2DF6B9EC9343D56
SHA-256:	6665E6128C83910D24E01C4AAAF8687E607A9E17A8C9FB1A1659C5BA71484EFC
SHA-512:	D3BC3EC9A244071D3236F39473E88C8907DBC98131A2625B4E64FCBFB9440401665E8C479B04C071410D0C5CE9358ED007122A7DE3E26BF1D6F835124F2AA977
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a56874cf898242d598ef1cb3b495e368.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70563kcnEuT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.433224780712886
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm93IzSiWkqs2lsjs2BbM:SbFuFyLVIg1BAf+MhqqkqF2jNdQIeXD
MD5:	EB52AA979A6B04480542741C872B6A85
SHA1:	0271C58D0E8000CC1396BDAF2773190D1FF031D9
SHA-256:	27EAF9FAA1D3DF037F99F51930C9B126766BFB53591AAC18DC0EB722E596B3C7
SHA-512:	452D24D5FA7D272770CAADA411FB6534FFF568E156263724733D765E59BEC52ED67CF5B7A3BB1BAE9B54D5A401368A23BB2788DF5175D5C73772D78680CBF366
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ee109a3e96541f7974e0cfd814fc0d3.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70564giMLEU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.435661650245817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8hiBwAmRHFBwUdVqS:SbFuFyLVIg1BG+f+M8EBwAmRH7gjLkGq
MD5:	6006D6E8CBCA5A11F87E045713E16D74
SHA1:	BBED6AFBFF5F5ACD896DDF300907C82FB9DF80B3
SHA-256:	C156352E9CF7BD7E41F5E713669FD2AA397C3BFCC703641ED9C0E53664E8963E
SHA-512:	2C2BFE29E62BB511972E9991CFB554436E50F58746E6354CC850174C7E9B80FA1A2EF49A87DC41F636D83E187345CFE9EA70CADAF12FB3F1D337324F900F93AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=695700f843f94434b8bd3916eb6af786.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:70695FQ4rNP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.453360563061165
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvAMD2qoSQXW0Klsjs2y:SbFuFyLVIg1BAf+MIj/SiFjNdQIeXD
MD5:	B424E554A515FE8FC861718175CDB908
SHA1:	8B323F9EFB176E9E0C6D4E823A5A18C149C24F67
SHA-256:	DD406F479DE90E392D21433399277DCF434C48E67A6E981152EB0D63F0A244F2
SHA-512:	23ADFCB81E9D058E8FDFB523727FCB33517EA8FD0FC22EDCD658D052323841A4956D1B98952C522DDA224A4D9E56CADC063F346AC6D52FD4F3DC76E3E13590DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec2b628a52ef45afa227bb5e0bab3471.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72653Dy4wcE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.407256575247004
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5VMGdMDedxxh+sjs4:SbFuFyLVIg1BG+f+MzM0HZjoa
MD5:	4F68DACA749F06705C883E4D2233C124
SHA1:	B1E0F3496A4AA483A9AD66A73E971B1AABD16332
SHA-256:	0150C9260FDA790A58D0E2306892F6DDFC8B7F293072455997955C5496B21824
SHA-512:	DBA0F9B8B16388277863AEABE8D4E1D9B37C4A90AAF673B38F8014F49D43F61483E2B321E0909C4E6CF8ADF3899C6B02FC59C6C896FFA06E67BB2D9A0A3CEEA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39d7029c8fc342489c47ff1a6791bdb3.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:72655HkLEuD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.362710955362607
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+bjERABJokjshQJWQ:SbFuFyLVIg1BG+f+M+3ERABDjtWL0
MD5:	4B25C02C33E175C22DF31BD710395BBA
SHA1:	D4929C0A0A3E21129415FB856EB004F4981E200D
SHA-256:	1AB68F6336140596C714EB955E2CC90E9BC186A05FA7F44C0398660065FE0BBD
SHA-512:	80AE9195D6A59895C2128711B3B7E86FA1AEC3E1F9B7166DDA5310B721939762D912B59E9D1DD2DB9C2BCD06433FD6937DB33FE0B8C827042D897E57DC096258
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=492a848c45f8446ba57ca4edf0737035.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:72656Bye0pF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.365147216105617
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr9PT/HDAKEEl/B/vU:SbFuFyLVIg1BG+f+M5rHcKtgjosQu
MD5:	A0965FECDAF141A8AD573ABFE7ECE7D5
SHA1:	1DBBCA400C795CC502C3D67432718AB7CACF78E0
SHA-256:	B269D4EB2145D98043179804D77E79459BDB783B757E0773546BBC73E156D6F4
SHA-512:	68DE930086EA0C75B1FC9316ABB2B32CC543745E17220E434E00486F39A0005CD1AFA9316260B628D7A43905FA7BB8A2BAA3208DA40C0F22ABF609C232095CFC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a026f3100b284ec8aad6aa50d8ac3662.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72658fXMHAC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.457803400243667
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp/nbHaRcLGe0hgrx5:SbFuFyLVIg1BG+f+MBfogrqjNE
MD5:	0A5742691FDABCEDEFD7A158D55F0A11
SHA1:	9A4966208CD05378724F0DC25F97AA80760AB45F
SHA-256:	50AF659853D339F0835159E0278AEDF6ED6307923A7D86EEF12407F25225F0E5
SHA-512:	9EC39B7EA619E5F8D6086A6DAE51BBF47D86F0BDEAF5B7E81F8CCF5930F30700FAE30A9DC9B0FFF766FE887BEB18F62FF5D0288A4C34920A9B0DE284CE706AEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3175b4ddf4b453985e829891c2d9383.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:72659w0DE2C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.517784201776323
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4TiNWmqjZcHcljX+:qgFq6g10+f+M4GNdkmAu
MD5:	676889AEF86513781A4CFA9FAE7B51CC
SHA1:	82FD8CA95774EC36FCA7C5DC2528A5B80E8B32A1
SHA-256:	19D78A22214C5F255E6D77F4678CE49DE6DDE8E0694070D11AC5B83A8B790454
SHA-512:	1A4FAC3EB05173E50F9A36E95FDBA899CC3F4B60A6FE3B6A4EA5FB344D282A66BD537C27DA644FDA62DB47EF2D65999C925D7731D7041B731D9DA53C367F8A22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20d64b1152364c3598015bcc391234f7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72663sYNwhF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.423495525942972
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm89KDXttdVStWMxsj0:SbFuFyLVIg1BG+f+M8K7jbVC
MD5:	A408E57CCA7B0E952465D6ABE142699C
SHA1:	A59FB3B8B66BF771DB6B32570745A9BDA7F7BA24
SHA-256:	F38FE59CABCDE19EBFF5EC0ED10C243966CF1C39F7034ADC848BD93D903DAEC9
SHA-512:	B30935693592E90421EA4CF563E9AD9712E755D40AEBBFD1BC4B305DFA50F6D0C07C1CE8DBE31705555658880F7A89019FDEDDA76AA0B445E89EB6AD3EA03E82
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=601425f3f27541e68d48ffbda3d78ca0.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:72665afxofF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.493311120025167
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8sUEZYVCp022jZcHcljX+:qgFq6g10+f+M816TbYmAu
MD5:	5F85A070A43A4A8F1BBAB7E559BD7260
SHA1:	D6AD81687834E2A121B2C4EECDE8C19BF0D9FE41
SHA-256:	B8987B3EF919427DDFB9245F5A2C1E53EEE2B1005A20EC59398D5F341ACFD013
SHA-512:	0567A82EDB5D664490C71D74A2D98F885A0937DFB974AF5B26EAC1EEB07091590DFBE59D827C49F5FA94AAA7FADD848862ECD1760132FE5789DBFD1BD2903CBC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6981c6bc2283489a91eefc7dcbeb4460.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72666ZH2z8F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.358818402618676
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzPoAQu315Jg9jshQJ:SbFuFyLVIg1BG+f+MEu315IjtWL0
MD5:	AA1C969C8910727701994E656A3E6728
SHA1:	5CB38D64747523B385B210EB72A55CEFB19D6D10
SHA-256:	D72F3367AE78C58654272CE3D0E6CA1E13980D8EF92EFE695B3C2EDD6B8A9783
SHA-512:	CF09643FF9B7013A7C08AFA7F12A3073FCFC8AD704E5AD64F53BE1D85E4B675E4FDD5AD2DB874A538ED242558FD430D36CE358542748B0D75793CDCF1430DF83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b576f0e61804578b350bba67673b259.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:72667a58fVE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406331836429392
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuuAD8eBWq98josQu:qgFq6g10+f+M7m8eiQu
MD5:	B11AF487D57564496A5B2271B13B162B
SHA1:	F143BA5FFD2A8C15FE60CED896B73079064BFE11
SHA-256:	68420012C50F3672287C4B7BE16CF3684C6E248B65503115A8AA3C2C6E54A894
SHA-512:	DDE3D35E2ED0EC59F8C79BAD4E2D32F63658166C8D3AE4EC001BC48916553A528393F3DDEA473534A6BB0E45BDCAF79A78FCAE1B501C124B0ECA8C50C86EED20
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dabd0419070e4efb938024cd37c936f4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72675E5KDtC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.441735460488949
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+eKcpyNQBTSq1vAgr:SbFuFyLVIg1BG+f+M+qT2jNE
MD5:	B55FC16048CE79548CCEE433C80BF46B
SHA1:	AF531E384CC44AB48BAB7E1852021C52E3FAA41B
SHA-256:	2080542D59C4EAD05F3FCD1C4ABAED8CFD3F685A27DB6C75B6A99BFC81F3CC49
SHA-512:	E1E23806254640D68A27BD078F6EB8C0BBC03D29664723BCDD4C0B5C473D9D21285F7B623DD6A45A112ED43BBFB8E3A7047EAF543CCD7A2ED8712A377B5EC64A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4368914b99da484cbe2ca3d35d670edf.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:72676PX8Z6D

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4619504795029
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4tSaiK2jZcHcljX+:qgFq6g10+f+M4dYmAu
MD5:	2736FA41E4FEC6EAD2DE9C64E580E2CE
SHA1:	BBABF1278E9E6B24CAEDED0A37FE09CDCF24AE86
SHA-256:	0BE8AA2BF592B5A393FAF1A11BD56F363C320D8BB24F5259D5E22FEAAA50025E
SHA-512:	22CD91763327FA2F1AAE1BD91C423AC4328CD1D904347E72150A4335140EC2D8B74338CCEA9FA22CE3C30B9BAC3D29EB43238A0EEC61B9EF42D64FE22C93F18A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=74103126734e4673aa366f648cd20db1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72681xf31HC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4034961821863385
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGeADGH0sGWmY+sj0:SbFuFyLVIg1BG+f+Mo7mDmTjbVC
MD5:	4F6E478019F144C8E30DEE7ED41895F9
SHA1:	7704F6042519A5B4C3DB47C0F15C6B61DB550514
SHA-256:	A936604147389C4B3C1BBA8B8A2C5ACF5A77E4666FFDEED41E2B61E4B21BA2D9
SHA-512:	BBAFCBC4B14292CE3E248ACC66E1FC2274C5D218237406A393ADD94FAF42D59FA0A5A447439B812501B0C48BA2ABD70530CDB959A12FA8EE7C31D7C3867D3659
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc67093cf36c47b4bc510cd2ed37771a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:72682Jjh1EG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.423689414689696
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9b5JW5bRTTTDClsj+:SbFuFyLVIg1BG+f+MZiTTq2jLkGq
MD5:	E9AA8A461AC5940850B12FE18331464B
SHA1:	256A36A99B507C0970F0976783DF003F31EAEE69
SHA-256:	F6ABC5B5A916E5CDDA816D56B6B6204E5A38554EFFD72003F95A4B8D5231EBED
SHA-512:	836A30BAF35A2E94D1DA755FA12276EFA1CC3F8590041661B5DA214080D7B4EB79C89AB2AFD8C03F7E379759B44242421B6702BC4E06B90083A439C5AB2AC924
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7c1ba3ad959340329eed81184662ff0c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:72684vEsgdE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4677512602465494
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmptVyRTzdS8eF2js2ALl:SbFuFyLVIg1BAf+MvUTxJjNALyAZD
MD5:	116D3A32168DD015E18A27912527F43B
SHA1:	357E9A92DFB0B9FDF48934B9D4FB1FE4C59DFDBE
SHA-256:	A513859381CE4E689A9480DFF4EC6B6D134BA3A738799E4E6F3BBCC1190F14F9
SHA-512:	CC19969B3C410B9B1D50CBC41B1374A966C1EE557D88F406118982507501507A10F240BCD7CC860FFF5F234646B2E343A577A71E0018230B3FD01D59BCC19206
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c30b10b7464041849776f6c8bca25d56.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72692zmWIZF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.403445544219271
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmujjVqKFxsjs2BbQIeXD:SbFuFyLVIg1BAf+MujjHFqjNdQIeXD
MD5:	387AB4370F529A0D5F92E55F7B621627
SHA1:	F3246B7F686A183A1DF82C7E005E0C9698DC8B1A
SHA-256:	EE3262F3F09DB2DEDE664B760FEBB1F5085DE2D6BDBB63253CAB3BC404B1E16E
SHA-512:	7FA46A0463112B1C3B0272D72DCB537015A7253045203D1593E31752E82DC5BDCDD7AE71CB3B7F8F180B14BD25EB55735C2BA767A0BC3FA2BE64632E18DB627A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d5aadcaabffa43009e601a1d895032ac.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73734wIMTgF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.388549662266632
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/tCwFCGUDEgTjs1Ha:SbFuFyLVIg1BG+f+MllaEcjoa
MD5:	C59E84F4022B13FFA3804B0E72614C0D
SHA1:	1628984C479789B71832B4412640427F2F7CA108
SHA-256:	DCFE31940B15C54AD48BC1F46A75651121ED14BB54D7EDFDBA5CD588BC1277E4
SHA-512:	3A759834A5346DBF5AF836882B37C0ECE3F5D82D7CAB32BADAE3BB41C0BB20E07236309314E49E42AB4FCFEFA8C1F5340F17A84868ADDA53EEA120DE1EE3ECD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5df7ec07f1924f87aca6a4326b01fa66.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:73850qfap0F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.418564053703011
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm64lV1mhgyqjs1Had9:SbFuFyLVIg1BG+f+M64dmiPjosQu
MD5:	5375D1D43BC272F422B1662385E5357F
SHA1:	BD2C98AE1FEFFEA3DF917C298D550126545D1E6D
SHA-256:	8C6090AFEBE893FC5AC17D0361486E5EA023A1066A89F4F18C387CE388A05E47
SHA-512:	2FF1E46DAB8CEE8EEEEE65ACD7818117D43978EBB00099E273BAFEF87048695DF06480776004EDBA474C7117CDAB754F6E139937F135EE16E79B7C8AC011A48E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a40bd4f8405492685d29b68d8eb567d.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73870l4HkFC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.356879424019739
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm97la2FRDTQlKaA+sh:SbFuFyLVIg1BG+f+MTa2FRGajtWL0
MD5:	7EDABE3A919D7BD6A2DAC4B21CCF5508
SHA1:	C1AA9B1890F7F443E3F29A42BB268A11531780BF
SHA-256:	FB6647CAF44D1C0A4A6A539408AC9887D2B0DDB13DFBB9A9679D71AD15FB93C0
SHA-512:	AEF2E28ADFAD9C18B842B9EC1117900729E453500EF16A09D7C02603DBD0ED6341756583D975669C2D6A6406C3887B3AA10695E9614E9247315667019F13C903
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=704b206309fa410f820f849c57359ae0.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:745328JGojx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.49986611764061
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MdQj1HaATjZcHcljX+:qgFq6g10+f+Mdw1HzmAu
MD5:	1DF8EEC456268DD9671F224BA89DAD81
SHA1:	C47A7116E3977FC93187081E8A3153C12633CC2A
SHA-256:	A1AFBBD4A2F3CD94FF39CA1B3CBD80E5BD77857F30B8442DCD551BA79D7B4C59
SHA-512:	CFB6C1688C4A9D691A32BD5E8F1DFDF6737423887D3BC5FA572DC0AC1DFD17DFAC84EFFCAB487BEB7B4F2EDEB529393B37FC1F0A8B953860E1A6B4DE36CCAC03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3289c33851544ca9a6da188fa6ba6b7d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:74533kb5Imv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3985557954900845
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoE8TlsYQvs2lsjs16:SbFuFyLVIg1BG+f+MonhZjosQu
MD5:	1A780996867A20694F1EDA6F5B6BDBDF
SHA1:	AC8BE3BD5B256700C8099F4353C39375CD598D1A
SHA-256:	E7159369AF542748B0645BBD72AFCCBEFDFDEE7A5B8D0AF1C4CC233996D1EE01
SHA-512:	F62298902AF9460B012C5FD0CD9F1D10FF5683E668927754DB4A994048FB2629EB713F06DF5D1E1661F29FB1E7B83F8ECC12EBC9108309728DB6DDC4A8C72749
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba7d3ca724f144da957f0e2dce123c31.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:74534gAkvru

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.392429225035298
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm81Q+DQEgHHQvswsjx:SbFuFyLVIg1BG+f+M8TDQECwv8josQu
MD5:	926EED68E78DFC0F23B9F6FA9A5292BD
SHA1:	D925A43AEF9323386125CD937171A8A0706F5D5A
SHA-256:	6308608B64E2037BA982418B810991FF47ECCA1E211ACC5F7486C4D5C1E5D9A6
SHA-512:	E824D7B50203916A67E2F0D7D55BBBB3E409B3643B32FEFECC61BE655E810E7A145BD8CEF4818A98EC620B7F485853001754F1F74DB75CEFBE6E50A18279BF88
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60bbc87eaa13459abc0914a58cbebb32.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:74545lGFc4s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.437044683981279
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoA3hr8yijTjs2ALAXaN:SbFuFyLVIg1BAf+MorbHjNALyAZD
MD5:	8AB62CD80ADABDF731D50CC2DBBE7A4D
SHA1:	A6A2C0399306410E747B1732672E97C6CDD1F64B
SHA-256:	5D9ABBBBECD2C6CD4896B2000CE85CD45D6D22F05BC0F2AF626D40B92FF117E2
SHA-512:	06F89939D1F6020859407FDA0A2B3BC93DD076EF4D1D6C533E788F0C1A688DBF0EF5FEE81C0E64D133100AA79759FD1714A0ECEF7FD0B4616FDEA8224C6A4260
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=be86429f180b444d8a07d84d214ff6b7.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74552BShl7s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.459171894933208
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MI01LjDJ6rqjNdQIeXD:qgFq6g1af+MIqXDUM2D
MD5:	9F2265E4D8B8C8BB4DB1BCB397F169F6
SHA1:	61677E3C2D4D9F75DE1CBAF58DF33C898C6EE07F
SHA-256:	1A851AE63C6F4B7794117090DD45BB0813CFA714A397E3E7326DF75E7E92EDB2
SHA-512:	4696AB7550A214D514125055C14FF9E39E3CBCFBA5D4C008915F786142F23CF7546DC9B5BEAC5C4CA99BBB67EFB6E9BAF00401ED27AD6DF4F14748EA99C5B226
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e76c519074084885a62caf8147c17c4a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74553OKLxlv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390747063681934
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7iZTuiAJljXsjswkT:SbFuFyLVIg1BG+f+MGZomjLkGq
MD5:	D1BA157BC97BA41F7DFDA291FAFFA38A
SHA1:	588602B11C6791B92360B5409502E8E73758AC06
SHA-256:	8554CC553AA52B8C31797B21CC39B7F7E805B6FDED0293F54FF5A3663BF48156
SHA-512:	FA12F650C33459F3F1A96742CCF6ACF594E8A63184B59149A24309F3DA75C3E17328BD3709CA0EFE16DDF7F4EBA16515F493C8C534D068C7383BE0919643D5C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1aa5783f08784a50a671cdd938f31f31.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76043xeCuGe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.462784813275823
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+9NqRGGYTjZcHcljX+:qgFq6g10+f+MvGhmAu
MD5:	BF317EEAB04DB1EBCDDBD19E26781572
SHA1:	2C04B986BC490C50E6AFF18B147D404542902CD9
SHA-256:	66DE0A61B30F7CB6D045CADCEAF8140FAED376EC1F4316D3514E6A9A2F30D508
SHA-512:	BCEDA36B53472574297B7B8BC9A1BBC550D04923CBA5FED56F1B6660C1DB94B712A24734DCDBEDDF3B7FA1D07840558047192CA9AE87D4F64A0735F708285EEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=47c31f648637440c8beb2adb4bded2cd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76044EJPqPe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.429707394599777
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+NaReq4XKB6RQjs16:SbFuFyLVIg1BG+f+M+NaReZXa66josQu
MD5:	7C1186F07B447B45652CFC92FD45C8E6
SHA1:	7B5C2C258321383E5C25453817B0B737CA8655E2
SHA-256:	7DD3BDA4485163818D39400C41E9071794CFD58DEDF53D6E6E5609645F4342F2
SHA-512:	FF414E4CDE593253718F7619A611036F9981160DC76CCD46D86E419B63D90DC086ADC72407D3E91E5369F0D48BC7B506AE93EA89E25FFAC8580A4766F412150A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4570bc1aef9046769de1a42c8d0546c5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76046joOX7d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.409991891815006
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpCSQoAHRQfdEUGAqc:SbFuFyLVIg1BG+f+McF2fal2josQu
MD5:	57971C8175BF265EEB50843E71EF46F8
SHA1:	92BF34B2F76C4CDA2F0EF3CE090E06F6F2ED6FDF
SHA-256:	7D7387711BD63902C731A06FADF503A297F2DC531CD79C869EC57D6AE413D815
SHA-512:	CB70A815A6CCA406535B7FCB86C14BBD44CCE5949D32BB9CCF60B78A4E04ADB4C80FF7D415E43EE4B752CB9F6561AF8AF90A0443A33F452F3995D1D6F95BA588
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3baabde1075438eb451c8a1cf92ad60.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76047X3N7Dg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.413604548261268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/jUGWoVWNkSXishg2j+:SbFuFyLVIg1BAf+MrzWNbXe2jNALyAZD
MD5:	7C7C715086B2FEEBC0EE72004C03F163
SHA1:	CC9D33497A58C02F70659139D4ABCCE711CD926B
SHA-256:	E7B823AEC0B5F1635E002F650366240E20C1F251458B8E705810E8260FAE57B0
SHA-512:	4CB8D1A68965F50EC4FF393B0E14C169B9915D758AEBB7142009DDC9009AC3D04EC04733E5E2BED6BA4018CE9AB9D5F31056C91913772E7B1DC08E62A3D8F1AF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=50b4344a50c3427fb82032af07ba7207.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76054WHu6We

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553766
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvwd10HeUB+U0hgrxN:SbFuFyLVIg1BG+f+ME0rEUYTjLkGq
MD5:	9C63491CF5CA289BCCD3F9315DBB8484
SHA1:	0C81D4406C1F9929C84C7FF8386DCC1200D7E5BC
SHA-256:	A3B357C4332ACB2E49FEBC5B59DD72854D9A4A1BD77820FD5919A35943AF0CF0
SHA-512:	2B118C419380B4EFDBA25733C185A938304A025853EC2EFAA0A56C5B8C2577D4E307443141F74A386E45EFA6EC42A47538B6227D29E7720F43BD72B86F08E4EC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e08e83fb484c47bfa1f91df100fdd272.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76079BuFj3e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.441449129023358
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+cz7BRBrXGsMxsjs2BI:SbFuFyLVIg1BAf+M+oFXr2RqjNdQIeXD
MD5:	0A03B250D066C87978DCC10400177C87
SHA1:	0205BA3357C8A108B6BB04D5934629951D13EA93
SHA-256:	E57F1A2622D0D0C4092EFEF7113C8E7B2475E5EC7B4BC6E7D84A47C6B65D613F
SHA-512:	915A4CEFDB0CA23B808E3BBAE232500A17235D244B219CC4EF023DEE6F0856A138612AA1323285F77B4F951937BE55ECD9AC47C64B9CD9A55CC74EBB7D62B6E1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=42203e797a7d4a37aaed130fbbc4928c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76539xmt0zw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.514806828903351
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6iAZdn3NsjsicWmIo:SbFuFyLVIg1BG+f+M6RrOjZcHcljX+
MD5:	0A1DC7B9445ED5BA454E50E16F82427C
SHA1:	7072B1D96209FFFDD86AE9986C0784317A139C19
SHA-256:	04A61645EE391C3D179FC95AD50FF5418FD7178CF319C9E7FB2FDA4EE114641B
SHA-512:	EC9BB200732CC78939A419E9E2ABA2AEB68D834B8405C46F0BB0E3F0CCF676709BA9E4C23E0391F1A0DCF554226EEC7F85DA44545E42F79D901E41052ED9A6E3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f6053b1c56249ac8327b733bd67fb1a.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76540W44D6u

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.423782968975747
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/tNW/IIcSbDzaUsjx:SbFuFyLVIg1BG+f+MVNWwhCe1josQu
MD5:	C04AC0D7DAA916BA09EEAA667096D489
SHA1:	D23CDE94E854336F84B7CAA20EC9093F942C46C8
SHA-256:	3636F534D03EDE04B1578D8EE547634C0364AE9BA47DFF4A7514851C2BBEAAF3
SHA-512:	969E33819170B3BD4D114BEF629E06CFFC65AF005B961F19A5F93B0F1D2842D8473FF890FDAB3BB7A0EA4DF65C692A055F037E8E7DB03B3C6F54CD8EC0C4590E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=56066d31edcf466a9c4c9972f2f4063a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:765414WKdMu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.394628698908891
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4Npr0SGfRv5xsjs16:SbFuFyLVIg1BG+f+M4TodRv5qjosQu
MD5:	D4B9DE7AAA701FD87E233F786F137793
SHA1:	313D6730FE339E91A5F937B527F4C317A0F19466
SHA-256:	D51A9E718F7CA2DF2BB8B4AA32D0280D3F5C3953F2DFA64A0C71D07102E023E3
SHA-512:	320BF0B20A5D45AD9D08D9977C30CF59CA74F9D5798B2D3F50F8F1375B61FEBD443E46AFC92A2AB5423FC801FA49CA4B9AEB4FB7A450FCD706277CC4AED812F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22ab7ad1d4d8477ca8ecf55ba33afc33.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76549AfAQOs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.423501433837256
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvkDJZvRxsjswkClr+:SbFuFyLVIg1BG+f+MET8jLkGq
MD5:	0E27DF6C676934789ACEA7BC869C355F
SHA1:	8B9346C6F2C835C9C13091A9880ED2650239B217
SHA-256:	BE7A0E9EE88F58CC281F25A767605F2AA47845C967C6C4CE3EDA2EAA052E8946
SHA-512:	D22CD2C182A59FC8ABE88BB334619596C4BDAFEE37B55C272616169A1F6736FECF9AAA75DB334F9B15A459914ECC387A36876640DF5D9C4A4C2D8CE43BD741CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eb69420db6584a4e9d9e53f67f27a0cb.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:765507mAYou

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.471545219685263
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm51k3S7kBwxCuxsjs2Ax:SbFuFyLVIg1BAf+Mr8SYB9uqjNALyAZD
MD5:	80A806DE5294BD710B7C7503A8730A09
SHA1:	C03524846E29FC553A690A8103A41BB16E37A9C4
SHA-256:	28E896638D9091EBD8691F6A7BA6F38459DD6D86EA150C263B495C57FD474BE7
SHA-512:	4A626F5D6D83423117507B8B49DB968D073A54372369BE92AEFDF8E3B8A6310251CDE4867AFF545EB276F3612BDF0E326A23F804F7D08A533B46EDA6F2A9A1AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=322072ddf9244868bad9ce3426547591.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76568gyJggv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.460317582133963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm93XrV28UjmW2js2BbQL:SbFuFyLVIg1BAf+Md88UwjNdQIeXD
MD5:	9B917ACF03467AF723162F03EC398807
SHA1:	0BE8F396CE38EDB58ED2C394C16529D9AD2CCA6C
SHA-256:	236842721B6214D4FEF38CDB70E55CB45525E3462FA7C8ABAEAE4E2D08360242
SHA-512:	F00FF0120572DE7815EE4F1EE5F139BE44127798792DE61E5A921CB7A2DBD78C771C6D6A15265803113C0BB934B0265B474ACE191E1B8A1E3DE8BC6696F6F57F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7375920d57ce4ae685e921c2a1d04435.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77619TnxQdC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.507477808734736
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MLGiJDc4VjZcHcljX+:qgFq6g10+f+MLGiJDPXmAu
MD5:	C78A666DC5D247ECEC9B632A79442E91
SHA1:	60740BD8B157E8851CD8150EF4E8D4C2B9093572
SHA-256:	49AF92995BCBB917709421D69720ABF7B8456C5FE2417774885DB1E2B2064C0E
SHA-512:	D440546715C7A722B7A9729C4EE9BF0DB9FCE1E70542A3973361480790F52A74EEB85918FC87BB7C50426733449FF641F882597FF9B4C1299A5BA90A15831C18
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=94211c2afc7b4f6da1657943c1959bd4.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77620wLjoGA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.368976312125764
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyUkVVGGAV1KH2rxsd:SbFuFyLVIg1BG+f+MyUonAVEZjosQu
MD5:	81039714C9CB097E99A5FE34A5540869
SHA1:	2C5B9A1A41B0648B4E11F3B166C3EF7E6E9D1E52
SHA-256:	BAB10D025EDFB7F3D61A6FB520315B45655FD51630FF6E489D469EAF31EE538B
SHA-512:	F9B9E967C647D1204A26837F045D926FDA1DE3C231164F0630A4A0D68B6582A18971394F7B3F32F7B39A35999A9B790212F2537B3EC026BF86AAB727E4932526
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=883722ee0cc74e2ca9f20ce08c12c8cb.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77627BnKTgD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4487167076877805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/bAUiHH4pjs2ALAXaGS:SbFuFyLVIg1BAf+MTAUiOjNALyAZD
MD5:	E3CA5981FA5FCDAB1C5B31C1A2DEF4F2
SHA1:	4298C0F0F0E3EF7E2FB976FABA5B92EC2E9E0CDA
SHA-256:	09BE97298C03E1252CE58DC7D30CD712FCAA5AE1220EFEE357C60D8E2D888A8D
SHA-512:	3E5EE99D36875113EFA38262CD9B9A1DFCF5141E764EECDD489FCD8868B2365E06E8A6AEEB34A5944639C6E6925AE58A7DCDD003155288C4C652A75A48C69B10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b40bb98cc234673bf6e26da0c2b8c4e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77633AIFdBA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382467885676334
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmokwN1wXSmEVMURqj+:SbFuFyLVIg1BG+f+Mokw9zavjLkGq
MD5:	74F5C28843F5867F7EF85EC367907C2C
SHA1:	9CF514AE7B32301F86A19DECACDAEAEA31043CBA
SHA-256:	156AF523FB453F8B2E8D4B8BD6F5C13B3B26A032A59298BF7B329DCA20ADDAAC
SHA-512:	AF492689E00FC7527F7196C9B49D05B1E6A71758FA5F944A49D80771BD50A7255C8504608119D77A190B654B59B3DD73D92BAA84F5D9216B050DE6F0C3338D2E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6f9b550e2b043a0b57d44efa0f95caf.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77640nZGcnC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4747171385430455
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6dD7hxSAt0hg2js2BbM:SbFuFyLVIg1BAf+M6TdYg2jNdQIeXD
MD5:	5DE919DF1B1E433E4C0C25A26223B2DE
SHA1:	72D0341CD858916B665667BD4607D465BAD749AB
SHA-256:	EDF5A2CB1F75A07B2130BC4CD5311A48DAFFB348640223806A81A282149D6649
SHA-512:	A346A35199583457A6AFF395AB9CB78B2C6BE1AD75028E7E5CFD90A89742154B5628F8DCB56CD564F249A1F1D944A3CA1EB6CD55EA8D97BE44CE48D1467BF973
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02052abf904344188bd94d84537f9585.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/seats/.#seat07HrFm1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat08oXQWI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0EGiCS2

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0JgCZiJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0NkaQKr

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0US3HBg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0bNcjVs

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0eSJBn8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0gPJ8IG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0hFtUy0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0hPJzFZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0k6nTRg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0mgYsns

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:r:r
MD5:	354D8DF91EBDE5315ACA61625024B859
SHA1:	336C0D1F87FABF676BF1844F96E4CAD063AACFDC
SHA-256:	9903805017B050C98C491D6780A476D27B4E836628BAA802E58444547DCB3CB3
SHA-512:	B44DEF91AFC0265E33F078A74662946A89E88044DA1E134C72F90E56086B16D6E41D01C692C83F17DC0036FB9BAEA42B514FC10143039936B36B55DF9993D829
Malicious:	false
Preview:	6486.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:ZsXlXEWtl/mKC3Nl:k+ylw3
MD5:	91B7EA5074988644B6972B40EF1343D9
SHA1:	CB1B4D9BA2768B9F9ECA4B000DD123CF471EE342
SHA-256:	F2C4723DFF3968D3E6A91B2599A0713DE28483A7A2AE15BF6BFE04105DFA815D
SHA-512:	4ECF090AC4E507773A99C787555E1B9C7CCD029BF7C95B59150E0136924545526C3E261551A9E15FB02C5B9076FA0779E7600B4173F57566D535555CE5FAC1F9
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................M4lg.!......................................

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.937303178619724
Encrypted:	false
SSDEEP:	24:vDm2ZeazDm2Z4BzDmoGzDmQjDmxmDmTAvrDmTA2+VNDm+:vDpDOD6DPDzDRvrDRfVND9
MD5:	94175A16420BE3A60066DF6F2C5360BA
SHA1:	2AEE27E2BEECCBFA0565D87959D44D0070625746
SHA-256:	6EB79261FC944033C2A80C8D11FF94459AEDD0D412F8CFFF87137511A5553443
SHA-512:	EE308E4A11BEA1694169D38C3773C56286658A353265FF72BF7A00D167FD0E97C03ABA7DB806D9160C00C89F7BC0DC6398C4E3A908A17C3E9370A08C8690D635
Malicious:	false
Preview:	Dec 25 10:35:27 galassia systemd-logind[6874]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 25 10:35:27 galassia systemd-logind[6874]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 25 10:35:27 galassia systemd-logind[6874]: User enumeration failed: Invalid argument.Dec 25 10:35:27 galassia systemd-logind[6874]: User of session 2 not known..Dec 25 10:35:27 galassia systemd-logind[6874]: Session enumeration failed: No such file or directory.Dec 25 10:35:27 galassia systemd-logind[6874]: Watching system buttons on /dev/input/event0 (Power Button).Dec 25 10:35:27 galassia systemd-logind[6874]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 25 10:35:27 galassia systemd-logind[6874]: New seat seat0..

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlJKSMYhk/lvKSMYhk:F3iYCqY
MD5:	767311FD2A9351F23B0C0EF6AA648BBF
SHA1:	37E630D69962F3D5F390BCECED65267E8D7B0BF7
SHA-256:	B2DFF05E3FE2A7A10033AC9AC5C12EB284442342AB240877EFFE64D7AFF9DC89
SHA-512:	BCD02BFA5ABB53C0568F08D7DFF1B2509186A9BD83988962CFCC83AE2A0A5BB9AA3FD7E686E10D23CA7EC29E35E027863D103D47D3CC7EF746A0483AE6F9BE8A
Malicious:	false
Preview:	LPKSHHRH..................w...E..:.}......................................w...E..:.}............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HleRocjRllgRocjZl:F3ORjjRllgRjjZ
MD5:	19DC841F52FC602D691C9CC070A307A9
SHA1:	9FEC38E0BD9D0C17373E3F24D523E2FBA965CF5F
SHA-256:	FE4449C4EB93C62A22EB9A1B4078424BFA2E7681CCFAB5875BA6AD768B50C323
SHA-512:	E4D9C123E113748CF69395AC5B731E16D58677484D158ECF2EF39140DFE20E480FA910FDB3CDD103185DE0AC16C05FA66BED7090AB3A4EF2F27A7D796A324294
Malicious:	false
Preview:	LPKSHHRH................./;..Fu....;.'................................../;..Fu....;.'.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2608
Entropy (8bit):	4.72010393026057
Encrypted:	false
SSDEEP:	48:vonY5onYcTonYWeonYH4onYammVXH/9Y2JlXH/9YYmmVvXH/9YEhXH/9YhmmJnXn:0fZLfvflfgfDf8LfKq3fugO
MD5:	600F34D4EE5D97BD118269D1CF9431C6
SHA1:	5465F1942FEBD9097896451E94D905D926BB6DE8
SHA-256:	6FEA91738BAE553ED1E1266FDD2B2E8DE7535BC5BAE83CA4CD162BCDA72DBD21
SHA-512:	1F24631072FBF42F26942C7546426FCE2B98CA3AD914409DCE03BD04E9672B42CB581CEC4E614C9B24A008064EF966A6B15F2F5052EFC1DD6E877C4A3006EACC
Malicious:	false
Preview:	Dec 25 10:35:21 galassia kernel: [ 253.631117] blocking signal 9: 5432 -> 3132.Dec 25 10:35:21 galassia kernel: [ 254.222193] New task spawned: old: (tgid 6934, tid 6934), new (tgid: 6934, tid: 6936).Dec 25 10:35:21 galassia kernel: [ 254.222384] New task spawned: old: (tgid 6934, tid 6934), new (tgid: 6934, tid: 6937).Dec 25 10:35:21 galassia kernel: [ 254.237383] New task spawned: old: (tgid 6934, tid 6937), new (tgid: 6934, tid: 6938).Dec 25 10:35:21 galassia kernel: [ 254.592948] New task spawned: old: (tgid 6939, tid 6939), new (tgid: 6940, tid: 6940).Dec 25 10:35:22 galassia kernel: [ 254.646083] New task spawned: old: (tgid 6940, tid 6940), new (tgid: 6941, tid: 6941).Dec 25 10:35:22 galassia kernel: [ 254.925197] New task spawned: old: (tgid 6939, tid 6939), new (tgid: 6942, tid: 6942).Dec 25 10:35:22 galassia kernel: [ 254.990618] New task spawned: old: (tgid 6942, tid 6942), new (tgid: 6943, tid: 6943).Dec 25 10:35:22 galassia kernel: [ 255.208577] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6702
Entropy (8bit):	5.047992441621057
Encrypted:	false
SSDEEP:	96:+cRT+U1VnQ5K3fZLfvflfgfDf8LfKq3fCfug9BJF86ENg:Rh+UngK+b2g
MD5:	D45DCFF11605791B4264FA6DEBA75AF7
SHA1:	835A84198352CFC5E3DC8EB33C295EFD47328C09
SHA-256:	102DC09C5199A8A571518C80635A08742F8C94566D300254BAF9ECAB7044B4D5
SHA-512:	96A8352F84642501ABB94E5C0107F090391F64FBAD1971A3816F06F0839916CE95B77AF1859A16B311F0D32738F03D8BAE12AA8F36798D70497A917621C05B62
Malicious:	false
Preview:	Dec 25 10:35:21 galassia kernel: [ 253.631117] blocking signal 9: 5432 -> 3132.Dec 25 10:35:21 galassia kernel: [ 253.637627] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 25 10:35:21 galassia kernel: [ 253.637690] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 25 10:35:21 galassia kernel: [ 253.805539] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 29..Dec 25 10:35:21 galassia kernel: [ 253.805550] systemd[1]: Stopped System Logging Service..Dec 25 10:35:21 galassia kernel: [ 253.806244] systemd[1]: Starting System Logging Service....Dec 25 10:35:21 galassia kernel: [ 253.940982] systemd[1]: Started D-Bus System Message Bus..Dec 25 10:35:21 galassia kernel: [ 254.181741] systemd-journald[6869]: File /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal corrupted or uncleanly shut down, renaming and replacing..Dec 25 10:35:21 galassia kernel: [ 254.222193] New task spawned: old: (tgid 6934,

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:ZsXlXEWtl/mKC3Nl:k+ylw3
MD5:	91B7EA5074988644B6972B40EF1343D9
SHA1:	CB1B4D9BA2768B9F9ECA4B000DD123CF471EE342
SHA-256:	F2C4723DFF3968D3E6A91B2599A0713DE28483A7A2AE15BF6BFE04105DFA815D
SHA-512:	4ECF090AC4E507773A99C787555E1B9C7CCD029BF7C95B59150E0136924545526C3E261551A9E15FB02C5B9076FA0779E7600B4173F57566D535555CE5FAC1F9
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................M4lg.!......................................

Source: Aqua.x86_64.elf	Virustotal: Detection: 52%			Perma Link
Source: Aqua.x86_64.elf	ReversingLabs: Detection: 50%

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.216285679316332
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.x86_64.elf
File size:	71'824 bytes
MD5:	a3a91d4d7b1a2a5ae8220ca1b8cc836b
SHA1:	76a2fff69bde33fb736b5c36e6ee5248f434cacb
SHA256:	21130be7fd8faaaeef35b1d0f92cb742b676a4b4764713deb9adb999c59b15bc
SHA512:	3fe6799d7b4b3ca9ce58162c713f956abef7f6026618b757d0e45a9dc7c03c759e5e99fc0725693b8d92d786db75c94e90a5ab10f1276f0c024f3edac7c42f31
SSDEEP:	1536:GBEtqb9a7oY6uHhK0ygRZKbBqAFcVfP57atD9kuQTGJ0OGjnR:htYQsYFwERYVqAFcxPctD6TGOO+R
TLSH:	85634A13B58190FCC29DC274476BB63AD93375BE1239F3AA37D8FA126D89E211E1E540
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@.....%.......%.................................Q.......Q............../..............Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	71184
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0xeb46	0x0	0x6	AX	16
.fini	PROGBITS	0x40ec46	0xec46	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x40ec60	0xec60	0x1dc5	0x0	0x2	A	32
.ctors	PROGBITS	0x511000	0x11000	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x511010	0x11010	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x511040	0x11040	0x590	0x0	0x3	WA	32
.bss	NOBITS	0x5115e0	0x115d0	0x29c8	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x115d0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10a25	0x10a25	6.3721	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x11000	0x511000	0x511000	0x5d0	0x2fa8	2.7250	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 25, 2024 17:33:08.938522100 CET	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable
Dec 25, 2024 17:34:28.950068951 CET	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable

Start time (UTC):	16:32:58
Start date (UTC):	25/12/2024
Path:	/tmp/Aqua.x86_64.elf
Arguments:	/tmp/Aqua.x86_64.elf
File size:	71824 bytes
MD5 hash:	a3a91d4d7b1a2a5ae8220ca1b8cc836b

Start time (UTC):	16:32:59
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	16:33:01
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:33:02
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	16:33:03
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:04
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:10
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:06
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:08
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:14
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:15
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:17
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:22
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/journal/streams/.#9:65094rZvrDV

/run/systemd/journal/streams/.#9:65095yiflcX

/run/systemd/journal/streams/.#9:65096DMU6zV

/run/systemd/journal/streams/.#9:65097I0E5tV

/run/systemd/journal/streams/.#9:65098MCMO7W

/run/systemd/journal/streams/.#9:65099v10FxT

/run/systemd/journal/streams/.#9:65111qcSkxW

/run/systemd/journal/streams/.#9:66622LWh70s

/run/systemd/journal/streams/.#9:66624293S4t

/run/systemd/journal/streams/.#9:666251dvkhv

/run/systemd/journal/streams/.#9:6662661tezv

/run/systemd/journal/streams/.#9:66634qTX58t

/run/systemd/journal/streams/.#9:66729zemMWs

/run/systemd/journal/streams/.#9:67209S3W50P

/run/systemd/journal/streams/.#9:67591rSfH5u

/run/systemd/journal/streams/.#9:68214V3AyoM

/run/systemd/journal/streams/.#9:68215pqCQSP

/run/systemd/journal/streams/.#9:68216U0aqnQ

/run/systemd/journal/streams/.#9:68222JirjWM

/run/systemd/journal/streams/.#9:68228FQQuLQ

/run/systemd/journal/streams/.#9:695141VHQTO

/run/systemd/journal/streams/.#9:69515AX7pOM

/run/systemd/journal/streams/.#9:69516xP6NgP

/run/systemd/journal/streams/.#9:6959696pJeO

/run/systemd/journal/streams/.#9:69762cgK8Ye

/run/systemd/journal/streams/.#9:697634MWdJd

/run/systemd/journal/streams/.#9:697648EXiEe

/run/systemd/journal/streams/.#9:69770uepxEf

/run/systemd/journal/streams/.#9:69782Z4ChEd

/run/systemd/journal/streams/.#9:697832wlT5d

Linux Analysis Report
Aqua.x86_64.elf

Start time (UTC):	16:33:18
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:19
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:33:20
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:21
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:25
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:31
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:33
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:38
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:34
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:35
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761