Edit tour

Linux Analysis Report
fqkjei686.elf

Overview

General Information

Sample name:	fqkjei686.elf
Analysis ID:	1583190
MD5:	b1cac6c2a1927bb33619b37f861bb91f
SHA1:	65984d2cf510b56444cf27e45f1e373603158fce
SHA256:	48aeb716656f78e79aac447a57d21e668159c30adc3fefd790744e253459e8b9
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583190
Start date and time:	2025-01-02 08:08:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fqkjei686.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/186@1136/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/fqkjei686.elf
PID:	5569
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

fqkjei686.elf (PID: 5569, Parent: 5487, MD5: b1cac6c2a1927bb33619b37f861bb91f) Arguments: /tmp/fqkjei686.elf

fqkjei686.elf New Fork (PID: 5570, Parent: 5569)

fqkjei686.elf New Fork (PID: 5571, Parent: 5570)

gnome-session-binary New Fork (PID: 5572, Parent: 1383)

sh (PID: 5572, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5572, Parent: 1383, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

xfce4-panel New Fork (PID: 5580, Parent: 3172)

wrapper-2.0 (PID: 5580, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5581, Parent: 3172)

wrapper-2.0 (PID: 5581, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5582, Parent: 3172)

wrapper-2.0 (PID: 5582, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5583, Parent: 3172)

wrapper-2.0 (PID: 5583, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5600, Parent: 5583)

xfpm-power-backlight-helper (PID: 5600, Parent: 5583, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5584, Parent: 3172)

wrapper-2.0 (PID: 5584, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5585, Parent: 3172)

wrapper-2.0 (PID: 5585, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5602, Parent: 5601)

xfconfd (PID: 5602, Parent: 5601, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

gdm3 New Fork (PID: 5627, Parent: 1289)

Default (PID: 5627, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5631, Parent: 1289)

Default (PID: 5631, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5634, Parent: 2955)

xfce4-notifyd (PID: 5634, Parent: 2955, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

xfce4-session New Fork (PID: 5635, Parent: 3011)

xfwm4 (PID: 5635, Parent: 3011, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2f0fb577c-8f27-49ed-9e22-22c0f8688bde

xfce4-session New Fork (PID: 5638, Parent: 3011)

xfce4-panel (PID: 5638, Parent: 3011, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 280cf4a86-48d7-4c11-938d-7ecb7d35458c

xfce4-session New Fork (PID: 5640, Parent: 3011)

rm (PID: 5640, Parent: 3011, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /home/saturnino/.cache/sessions/Thunar-2692b1019-2e62-4110-a5da-30fefabc5610

xfce4-session New Fork (PID: 5641, Parent: 3011)

xfdesktop (PID: 5641, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5644, Parent: 3011)

xfwm4 (PID: 5644, Parent: 3011, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 2f0fb577c-8f27-49ed-9e22-22c0f8688bde

xfce4-session New Fork (PID: 5645, Parent: 3011)

xfce4-panel (PID: 5645, Parent: 3011, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 280cf4a86-48d7-4c11-938d-7ecb7d35458c

xfce4-session New Fork (PID: 5646, Parent: 3011)

xfdesktop (PID: 5646, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

systemd New Fork (PID: 5654, Parent: 1)

systemd-user-runtime-dir (PID: 5654, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

dbus-daemon New Fork (PID: 5674, Parent: 5673)

xfconfd (PID: 5674, Parent: 5673, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5695, Parent: 1)

journalctl (PID: 5695, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5698, Parent: 1)

dbus-daemon (PID: 5698, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5703, Parent: 1289)

Default (PID: 5703, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5704, Parent: 1)

rsyslogd (PID: 5704, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5705, Parent: 2955)

pulseaudio (PID: 5705, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5711, Parent: 1)

upowerd (PID: 5711, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

gvfsd-fuse New Fork (PID: 5749, Parent: 3147)

fusermount (PID: 5749, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5750, Parent: 1)

systemd-journald (PID: 5750, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5756, Parent: 2955)

dbus-daemon (PID: 5756, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5757, Parent: 1)

dbus-daemon (PID: 5757, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5760, Parent: 1)

systemd-journald (PID: 5760, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5761, Parent: 1)

dbus-daemon (PID: 5761, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5762, Parent: 1)

rsyslogd (PID: 5762, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5763, Parent: 1)

upowerd (PID: 5763, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 5806, Parent: 1)

systemd-logind (PID: 5806, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5861, Parent: 1)

agetty (PID: 5861, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5863, Parent: 1)

gpu-manager (PID: 5863, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5864, Parent: 5863)

sh (PID: 5864, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5865, Parent: 5864)

grep (PID: 5865, Parent: 5864, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5866, Parent: 5863)

sh (PID: 5866, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5867, Parent: 5866)

grep (PID: 5867, Parent: 5866, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5868, Parent: 5863)

sh (PID: 5868, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5869, Parent: 5868)

grep (PID: 5869, Parent: 5868, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5870, Parent: 5863)

sh (PID: 5870, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5871, Parent: 5870)

grep (PID: 5871, Parent: 5870, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5872, Parent: 5863)

sh (PID: 5872, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5873, Parent: 5872)

grep (PID: 5873, Parent: 5872, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5876, Parent: 5863)

sh (PID: 5876, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5877, Parent: 5876)

grep (PID: 5877, Parent: 5876, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5878, Parent: 5863)

sh (PID: 5878, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5879, Parent: 5878)

grep (PID: 5879, Parent: 5878, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5880, Parent: 5863)

sh (PID: 5880, Parent: 5863, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5881, Parent: 5880)

grep (PID: 5881, Parent: 5880, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5882, Parent: 1)

generate-config (PID: 5882, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5883, Parent: 5882)

pkill (PID: 5883, Parent: 5882, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5884, Parent: 1)

gdm-wait-for-drm (PID: 5884, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5889, Parent: 1)

systemd-journald (PID: 5889, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5890, Parent: 1)

dbus-daemon (PID: 5890, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5895, Parent: 1)

systemd-logind (PID: 5895, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5950, Parent: 1)

rsyslogd (PID: 5950, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5951, Parent: 1)

upowerd (PID: 5951, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 5990, Parent: 1)

gpu-manager (PID: 5990, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5991, Parent: 5990)

sh (PID: 5991, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5993, Parent: 5991)

grep (PID: 5993, Parent: 5991, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5994, Parent: 5990)

sh (PID: 5994, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5995, Parent: 5994)

grep (PID: 5995, Parent: 5994, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5996, Parent: 5990)

sh (PID: 5996, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5997, Parent: 5996)

grep (PID: 5997, Parent: 5996, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5999, Parent: 5990)

sh (PID: 5999, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6000, Parent: 5999)

grep (PID: 6000, Parent: 5999, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6002, Parent: 5990)

sh (PID: 6002, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6003, Parent: 6002)

grep (PID: 6003, Parent: 6002, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6004, Parent: 5990)

sh (PID: 6004, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6005, Parent: 6004)

grep (PID: 6005, Parent: 6004, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6008, Parent: 5990)

sh (PID: 6008, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6009, Parent: 6008)

grep (PID: 6009, Parent: 6008, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6010, Parent: 5990)

sh (PID: 6010, Parent: 5990, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6011, Parent: 6010)

grep (PID: 6011, Parent: 6010, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6012, Parent: 1)

generate-config (PID: 6012, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6013, Parent: 6012)

pkill (PID: 6013, Parent: 6012, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6014, Parent: 1)

gdm-wait-for-drm (PID: 6014, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6019, Parent: 1)

systemd-journald (PID: 6019, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6020, Parent: 1)

dbus-daemon (PID: 6020, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6025, Parent: 1)

systemd-logind (PID: 6025, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6080, Parent: 1)

rsyslogd (PID: 6080, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6081, Parent: 1)

upowerd (PID: 6081, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6121, Parent: 1)

gpu-manager (PID: 6121, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6122, Parent: 6121)

sh (PID: 6122, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6123, Parent: 6122)

grep (PID: 6123, Parent: 6122, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6124, Parent: 6121)

sh (PID: 6124, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6125, Parent: 6124)

grep (PID: 6125, Parent: 6124, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6127, Parent: 6121)

sh (PID: 6127, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6128, Parent: 6127)

grep (PID: 6128, Parent: 6127, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6130, Parent: 6121)

sh (PID: 6130, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6131, Parent: 6130)

grep (PID: 6131, Parent: 6130, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6132, Parent: 6121)

sh (PID: 6132, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6133, Parent: 6132)

grep (PID: 6133, Parent: 6132, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6136, Parent: 6121)

sh (PID: 6136, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6137, Parent: 6136)

grep (PID: 6137, Parent: 6136, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6138, Parent: 6121)

sh (PID: 6138, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6139, Parent: 6138)

grep (PID: 6139, Parent: 6138, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6140, Parent: 6121)

sh (PID: 6140, Parent: 6121, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6141, Parent: 6140)

grep (PID: 6141, Parent: 6140, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6142, Parent: 1)

generate-config (PID: 6142, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6143, Parent: 6142)

pkill (PID: 6143, Parent: 6142, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6144, Parent: 1)

gdm-wait-for-drm (PID: 6144, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6149, Parent: 1)

systemd-journald (PID: 6149, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6150, Parent: 1)

dbus-daemon (PID: 6150, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6155, Parent: 1)

systemd-logind (PID: 6155, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6210, Parent: 1)

rsyslogd (PID: 6210, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6211, Parent: 1)

upowerd (PID: 6211, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6251, Parent: 1)

gpu-manager (PID: 6251, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6252, Parent: 6251)

sh (PID: 6252, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6253, Parent: 6252)

grep (PID: 6253, Parent: 6252, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6254, Parent: 6251)

sh (PID: 6254, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6255, Parent: 6254)

grep (PID: 6255, Parent: 6254, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6257, Parent: 6251)

sh (PID: 6257, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6258, Parent: 6257)

grep (PID: 6258, Parent: 6257, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6262, Parent: 6251)

sh (PID: 6262, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6263, Parent: 6262)

grep (PID: 6263, Parent: 6262, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6264, Parent: 6251)

sh (PID: 6264, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6265, Parent: 6264)

grep (PID: 6265, Parent: 6264, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6266, Parent: 6251)

sh (PID: 6266, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6267, Parent: 6266)

grep (PID: 6267, Parent: 6266, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6268, Parent: 6251)

sh (PID: 6268, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6269, Parent: 6268)

grep (PID: 6269, Parent: 6268, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6270, Parent: 6251)

sh (PID: 6270, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6271, Parent: 6270)

grep (PID: 6271, Parent: 6270, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6272, Parent: 1)

generate-config (PID: 6272, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6273, Parent: 6272)

pkill (PID: 6273, Parent: 6272, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6274, Parent: 1)

gdm-wait-for-drm (PID: 6274, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6279, Parent: 1)

systemd-journald (PID: 6279, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6280, Parent: 1)

dbus-daemon (PID: 6280, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6285, Parent: 1)

systemd-logind (PID: 6285, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6340, Parent: 1)

rsyslogd (PID: 6340, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6341, Parent: 1)

upowerd (PID: 6341, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6381, Parent: 1)

gpu-manager (PID: 6381, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6382, Parent: 6381)

sh (PID: 6382, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6383, Parent: 6382)

grep (PID: 6383, Parent: 6382, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6385, Parent: 6381)

sh (PID: 6385, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6386, Parent: 6385)

grep (PID: 6386, Parent: 6385, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6389, Parent: 6381)

sh (PID: 6389, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6391, Parent: 6389)

grep (PID: 6391, Parent: 6389, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6392, Parent: 6381)

sh (PID: 6392, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6393, Parent: 6392)

grep (PID: 6393, Parent: 6392, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6394, Parent: 6381)

sh (PID: 6394, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6395, Parent: 6394)

grep (PID: 6395, Parent: 6394, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6396, Parent: 6381)

sh (PID: 6396, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6397, Parent: 6396)

grep (PID: 6397, Parent: 6396, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6398, Parent: 6381)

sh (PID: 6398, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6399, Parent: 6398)

grep (PID: 6399, Parent: 6398, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6400, Parent: 6381)

sh (PID: 6400, Parent: 6381, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6401, Parent: 6400)

grep (PID: 6401, Parent: 6400, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6402, Parent: 1)

generate-config (PID: 6402, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6403, Parent: 6402)

pkill (PID: 6403, Parent: 6402, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6404, Parent: 1)

gdm-wait-for-drm (PID: 6404, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6409, Parent: 1)

systemd-journald (PID: 6409, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6410, Parent: 1)

dbus-daemon (PID: 6410, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6415, Parent: 1)

systemd-logind (PID: 6415, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6470, Parent: 1)

rsyslogd (PID: 6470, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6471, Parent: 1)

upowerd (PID: 6471, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6511, Parent: 1)

gpu-manager (PID: 6511, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6514, Parent: 6511)

sh (PID: 6514, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6515, Parent: 6514)

grep (PID: 6515, Parent: 6514, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6517, Parent: 6511)

sh (PID: 6517, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6518, Parent: 6517)

grep (PID: 6518, Parent: 6517, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6520, Parent: 6511)

sh (PID: 6520, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6521, Parent: 6520)

grep (PID: 6521, Parent: 6520, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6522, Parent: 6511)

sh (PID: 6522, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6523, Parent: 6522)

grep (PID: 6523, Parent: 6522, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6524, Parent: 6511)

sh (PID: 6524, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6525, Parent: 6524)

grep (PID: 6525, Parent: 6524, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6526, Parent: 6511)

sh (PID: 6526, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6527, Parent: 6526)

grep (PID: 6527, Parent: 6526, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6528, Parent: 6511)

sh (PID: 6528, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6529, Parent: 6528)

grep (PID: 6529, Parent: 6528, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6530, Parent: 6511)

sh (PID: 6530, Parent: 6511, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6531, Parent: 6530)

grep (PID: 6531, Parent: 6530, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6532, Parent: 1)

generate-config (PID: 6532, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6533, Parent: 6532)

pkill (PID: 6533, Parent: 6532, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6536, Parent: 1)

gdm-wait-for-drm (PID: 6536, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6539, Parent: 2955)

dbus-daemon (PID: 6539, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6540, Parent: 2955)

pulseaudio (PID: 6540, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6541, Parent: 1)

rtkit-daemon (PID: 6541, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6544, Parent: 1)

polkitd (PID: 6544, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6550, Parent: 1)

systemd-journald (PID: 6550, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6555, Parent: 1)

systemd-logind (PID: 6555, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6610, Parent: 1)

rsyslogd (PID: 6610, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6611, Parent: 1)

upowerd (PID: 6611, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6612, Parent: 2955)

pulseaudio (PID: 6612, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6651, Parent: 1)

dbus-daemon (PID: 6651, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6655, Parent: 1)

gpu-manager (PID: 6655, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6656, Parent: 6655)

sh (PID: 6656, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6657, Parent: 6656)

grep (PID: 6657, Parent: 6656, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6658, Parent: 6655)

sh (PID: 6658, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6659, Parent: 6658)

grep (PID: 6659, Parent: 6658, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6660, Parent: 6655)

sh (PID: 6660, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6661, Parent: 6660)

grep (PID: 6661, Parent: 6660, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6662, Parent: 6655)

sh (PID: 6662, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6664, Parent: 6662)

grep (PID: 6664, Parent: 6662, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6666, Parent: 6655)

sh (PID: 6666, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6667, Parent: 6666)

grep (PID: 6667, Parent: 6666, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6672, Parent: 6655)

sh (PID: 6672, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6673, Parent: 6672)

grep (PID: 6673, Parent: 6672, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6677, Parent: 6655)

sh (PID: 6677, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6678, Parent: 6677)

grep (PID: 6678, Parent: 6677, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6679, Parent: 6655)

sh (PID: 6679, Parent: 6655, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6680, Parent: 6679)

grep (PID: 6680, Parent: 6679, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6665, Parent: 1)

rtkit-daemon (PID: 6665, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6671, Parent: 1)

polkitd (PID: 6671, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6681, Parent: 1)

generate-config (PID: 6681, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6682, Parent: 6681)

pkill (PID: 6682, Parent: 6681, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6687, Parent: 2955)

dbus-daemon (PID: 6687, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6688, Parent: 1)

gdm-wait-for-drm (PID: 6688, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6691, Parent: 1)

systemd-journald (PID: 6691, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6696, Parent: 1)

systemd-logind (PID: 6696, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6703, Parent: 1)

dbus-daemon (PID: 6703, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6752, Parent: 1)

rsyslogd (PID: 6752, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6753, Parent: 1)

upowerd (PID: 6753, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6791, Parent: 2955)

pulseaudio (PID: 6791, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6796, Parent: 1)

gpu-manager (PID: 6796, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6797, Parent: 6796)

sh (PID: 6797, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6798, Parent: 6797)

grep (PID: 6798, Parent: 6797, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6799, Parent: 6796)

sh (PID: 6799, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6800, Parent: 6799)

grep (PID: 6800, Parent: 6799, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6803, Parent: 6796)

sh (PID: 6803, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6804, Parent: 6803)

grep (PID: 6804, Parent: 6803, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6805, Parent: 6796)

sh (PID: 6805, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6807, Parent: 6805)

grep (PID: 6807, Parent: 6805, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6811, Parent: 6796)

sh (PID: 6811, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6814, Parent: 6811)

grep (PID: 6814, Parent: 6811, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6816, Parent: 6796)

sh (PID: 6816, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6817, Parent: 6816)

grep (PID: 6817, Parent: 6816, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6818, Parent: 6796)

sh (PID: 6818, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6819, Parent: 6818)

grep (PID: 6819, Parent: 6818, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6820, Parent: 6796)

sh (PID: 6820, Parent: 6796, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6821, Parent: 6820)

grep (PID: 6821, Parent: 6820, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6802, Parent: 1)

rtkit-daemon (PID: 6802, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6810, Parent: 1)

polkitd (PID: 6810, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6824, Parent: 1)

generate-config (PID: 6824, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6825, Parent: 6824)

pkill (PID: 6825, Parent: 6824, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6828, Parent: 2955)

dbus-daemon (PID: 6828, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6829, Parent: 1)

gdm-wait-for-drm (PID: 6829, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6834, Parent: 1)

systemd-journald (PID: 6834, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6839, Parent: 1)

systemd-logind (PID: 6839, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6891, Parent: 1)

rsyslogd (PID: 6891, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6892, Parent: 1)

upowerd (PID: 6892, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6931, Parent: 2955)

pulseaudio (PID: 6931, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6936, Parent: 1)

dbus-daemon (PID: 6936, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6937, Parent: 1)

gpu-manager (PID: 6937, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6938, Parent: 6937)

sh (PID: 6938, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6939, Parent: 6938)

grep (PID: 6939, Parent: 6938, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6940, Parent: 6937)

sh (PID: 6940, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6941, Parent: 6940)

grep (PID: 6941, Parent: 6940, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6942, Parent: 6937)

sh (PID: 6942, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6943, Parent: 6942)

grep (PID: 6943, Parent: 6942, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6944, Parent: 6937)

sh (PID: 6944, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6945, Parent: 6944)

grep (PID: 6945, Parent: 6944, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6946, Parent: 6937)

sh (PID: 6946, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6948, Parent: 6946)

grep (PID: 6948, Parent: 6946, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6950, Parent: 6937)

sh (PID: 6950, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6951, Parent: 6950)

grep (PID: 6951, Parent: 6950, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6959, Parent: 6937)

sh (PID: 6959, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6960, Parent: 6959)

grep (PID: 6960, Parent: 6959, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6961, Parent: 6937)

sh (PID: 6961, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6962, Parent: 6961)

grep (PID: 6962, Parent: 6961, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6949, Parent: 1)

rtkit-daemon (PID: 6949, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6955, Parent: 1)

polkitd (PID: 6955, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6965, Parent: 1)

generate-config (PID: 6965, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6966, Parent: 6965)

pkill (PID: 6966, Parent: 6965, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6969, Parent: 2955)

dbus-daemon (PID: 6969, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6970, Parent: 1)

gdm-wait-for-drm (PID: 6970, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6975, Parent: 1)

systemd-journald (PID: 6975, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6980, Parent: 1)

dbus-daemon (PID: 6980, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6981, Parent: 1)

systemd-logind (PID: 6981, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7036, Parent: 1)

rsyslogd (PID: 7036, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7037, Parent: 1)

upowerd (PID: 7037, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 7038, Parent: 2955)

pulseaudio (PID: 7038, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7078, Parent: 1)

gpu-manager (PID: 7078, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7079, Parent: 7078)

sh (PID: 7079, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7080, Parent: 7079)

grep (PID: 7080, Parent: 7079, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7081, Parent: 7078)

sh (PID: 7081, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7082, Parent: 7081)

grep (PID: 7082, Parent: 7081, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7083, Parent: 7078)

sh (PID: 7083, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7084, Parent: 7083)

grep (PID: 7084, Parent: 7083, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7087, Parent: 7078)

sh (PID: 7087, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7088, Parent: 7087)

grep (PID: 7088, Parent: 7087, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7093, Parent: 7078)

sh (PID: 7093, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7094, Parent: 7093)

grep (PID: 7094, Parent: 7093, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7098, Parent: 7078)

sh (PID: 7098, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7099, Parent: 7098)

grep (PID: 7099, Parent: 7098, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7100, Parent: 7078)

sh (PID: 7100, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7101, Parent: 7100)

grep (PID: 7101, Parent: 7100, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7102, Parent: 7078)

sh (PID: 7102, Parent: 7078, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7103, Parent: 7102)

grep (PID: 7103, Parent: 7102, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7086, Parent: 1)

rtkit-daemon (PID: 7086, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7092, Parent: 1)

polkitd (PID: 7092, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7106, Parent: 1)

generate-config (PID: 7106, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7107, Parent: 7106)

pkill (PID: 7107, Parent: 7106, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7110, Parent: 2955)

dbus-daemon (PID: 7110, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7111, Parent: 1)

gdm-wait-for-drm (PID: 7111, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fqkjei686.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
fqkjei686.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
fqkjei686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a6f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
fqkjei686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a22:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
fqkjei686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa37d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa41d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
fqkjei686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
fqkjei686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa8f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
fqkjei686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xf97f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5569.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ca8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a6f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a22:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa37d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa41d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa8f2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5569.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xf97f:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: fqkjei686.elf PID: 5569	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: fqkjei686.elf PID: 5569	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xada:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff/fd/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/tmp/var/mnt/root/boot/home/dev/media/opt/../(deleted)dbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: fingwi.cardiacpure.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.14:34692 -> 178.215.238.112:33966
Source: global traffic	TCP traffic: 192.168.2.14:57266 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5704)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5762)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5950)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6080)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6210)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6340)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6470)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6610)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6752)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6891)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7036)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 5760)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6019)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6149)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6279)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6409)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6550)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6691)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6834)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6975)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru. [malformed]

Source: syslog.337.dr, syslog.83.dr, syslog.235.dr, syslog.453.dr, syslog.391.dr, syslog.137.dr, syslog.507.dr, syslog.567.dr, syslog.285.dr, syslog.187.dr

String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: fqkjei686.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 782, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1381, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1381, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3011, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3159, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3159, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3171, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3172, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3172, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3178, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3178, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3213, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3213, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3239, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3239, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3244, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3244, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5553, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5585, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5602, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5634, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5635, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5635, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5638, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5638, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5641, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5641, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1314, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1593, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1712, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2986, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3218, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3268, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3337, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3353, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3361, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3392, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3402, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3668, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5404, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5644, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5645, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5646, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5698, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5704, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5705, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5761, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5762, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5806, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5889, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5890, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5895, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5950, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6014, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6019, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6020, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6025, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6081, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6149, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6155, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6536, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6539, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6540, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6544, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6550, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6555, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6671, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6687, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6688, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6691, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6696, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6834, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6839, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6892, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6931, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6936, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6969, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior

Source: xfce4-panel.xml.new.33.dr

OLE indicator, VBA macros: true

Source: xfce4-panel.xml.new.33.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 782, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1381, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1381, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3011, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3159, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3159, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3171, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3172, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3172, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3178, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3178, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3183, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3213, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3213, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3239, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3239, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3244, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3244, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5553, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5585, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5602, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5634, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5635, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5635, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5638, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5638, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5641, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5641, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1314, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1593, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 1712, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2986, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3120, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3142, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3218, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3268, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3304, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3337, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3353, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3361, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3392, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3398, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3402, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3406, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3412, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3425, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 3668, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5404, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5644, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5645, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5646, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5674, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5698, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5704, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5705, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5750, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5757, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5761, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5762, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5806, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5884, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5889, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5890, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5895, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5950, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 5951, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6014, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6019, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6020, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6025, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6081, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6144, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6149, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6155, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6536, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6539, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6540, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6544, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6550, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6555, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6671, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6687, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6688, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6691, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6696, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6834, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6839, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6892, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6931, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6936, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6969, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5571)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: fqkjei686.elf PID: 5569, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/186@1136/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5698)	File: /proc/5698/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5749)	File: /proc/5749/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5761)	File: /proc/5761/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5890)	File: /proc/5890/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6020)	File: /proc/6020/mounts
Source: /usr/bin/dbus-daemon (PID: 6150)	File: /proc/6150/mounts
Source: /usr/bin/dbus-daemon (PID: 6280)	File: /proc/6280/mounts
Source: /usr/bin/dbus-daemon (PID: 6410)	File: /proc/6410/mounts
Source: /usr/bin/dbus-daemon (PID: 6539)	File: /proc/6539/mounts
Source: /usr/bin/dbus-daemon (PID: 6651)	File: /proc/6651/mounts
Source: /usr/bin/dbus-daemon (PID: 6687)	File: /proc/6687/mounts
Source: /usr/bin/dbus-daemon (PID: 6703)	File: /proc/6703/mounts
Source: /usr/bin/dbus-daemon (PID: 6828)	File: /proc/6828/mounts
Source: /usr/bin/dbus-daemon (PID: 6936)	File: /proc/6936/mounts
Source: /usr/bin/dbus-daemon (PID: 6969)	File: /proc/6969/mounts
Source: /usr/bin/dbus-daemon (PID: 6980)	File: /proc/6980/mounts
Source: /usr/bin/dbus-daemon (PID: 7110)	File: /proc/7110/mounts

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5580)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5581)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5582)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5583)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5602)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5602)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5602)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5602)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5634)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5635)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5644)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5645)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5646)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69362IYf4FL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69368kSli0K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69369yCe4kM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69370aOeSpM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69371oOCXTJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69380tVYqJK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:693817tKKdM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69382fn4KEK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69389W7ZbZL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:693902GYUKJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69411b6pXkM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	File: /run/systemd/journal/streams/.#9:69944EJpfKJ	Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5763)	Directory: <invalid fd (12)>/..	Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5763)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5806)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5806)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5806)	File: /run/systemd/seats/.#seat0anFJEb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5806)	File: /run/systemd/inhibit/.#1Cbk65d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	File: /run/systemd/journal/streams/.#9:70539HdlpGv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	File: /run/systemd/journal/streams/.#9:70548sVwsHu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	File: /run/systemd/journal/streams/.#9:70555sFOgtu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	File: /run/systemd/journal/streams/.#9:70563dq5rlv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	File: /run/systemd/journal/streams/.#9:70644CmhpHs	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5895)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5895)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5895)	File: /run/systemd/seats/.#seat0wnP97X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5895)	File: /run/systemd/inhibit/.#1DzHbwW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5895)	File: /run/systemd/inhibit/.#1Ga10RV	Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5951)	Directory: <invalid fd (12)>/..	Jump to behavior
Source: /usr/lib/upower/upowerd (PID: 5951)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6019)	File: /run/systemd/journal/streams/.#9:72103YqXgui
Source: /lib/systemd/systemd-journald (PID: 6019)	File: /run/systemd/journal/streams/.#9:72104omgWzk
Source: /lib/systemd/systemd-journald (PID: 6019)	File: /run/systemd/journal/streams/.#9:72111bGXPYl
Source: /lib/systemd/systemd-journald (PID: 6019)	File: /run/systemd/journal/streams/.#9:721197lFUMj
Source: /lib/systemd/systemd-journald (PID: 6019)	File: /run/systemd/journal/streams/.#9:7220224AsUj
Source: /lib/systemd/systemd-logind (PID: 6025)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6025)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6025)	File: /run/systemd/seats/.#seat0CuLPeN
Source: /lib/systemd/systemd-logind (PID: 6025)	File: /run/systemd/inhibit/.#1YY3eNN
Source: /lib/systemd/systemd-logind (PID: 6025)	File: /run/systemd/inhibit/.#1oUoPvM
Source: /usr/lib/upower/upowerd (PID: 6081)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6081)	Directory: <invalid fd (11)>/..
Source: /lib/systemd/systemd-journald (PID: 6149)	File: /run/systemd/journal/streams/.#9:72741ViPbba
Source: /lib/systemd/systemd-journald (PID: 6149)	File: /run/systemd/journal/streams/.#9:72748GGS4C8
Source: /lib/systemd/systemd-journald (PID: 6149)	File: /run/systemd/journal/streams/.#9:727561nYxy8
Source: /lib/systemd/systemd-journald (PID: 6149)	File: /run/systemd/journal/streams/.#9:72759jWAXM9
Source: /lib/systemd/systemd-journald (PID: 6149)	File: /run/systemd/journal/streams/.#9:72765QCFaX8
Source: /lib/systemd/systemd-logind (PID: 6155)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6155)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6155)	File: /run/systemd/seats/.#seat0rMaHlC
Source: /lib/systemd/systemd-logind (PID: 6155)	File: /run/systemd/inhibit/.#1r4LBXz
Source: /lib/systemd/systemd-logind (PID: 6155)	File: /run/systemd/inhibit/.#1LpVZOA
Source: /usr/lib/upower/upowerd (PID: 6211)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6211)	Directory: <invalid fd (11)>/..
Source: /lib/systemd/systemd-journald (PID: 6279)	File: /run/systemd/journal/streams/.#9:73180tkbPnY
Source: /lib/systemd/systemd-journald (PID: 6279)	File: /run/systemd/journal/streams/.#9:73187UaLDsY
Source: /lib/systemd/systemd-journald (PID: 6279)	File: /run/systemd/journal/streams/.#9:731959kAh6Z
Source: /lib/systemd/systemd-journald (PID: 6279)	File: /run/systemd/journal/streams/.#9:73196BamJ5Z
Source: /lib/systemd/systemd-journald (PID: 6279)	File: /run/systemd/journal/streams/.#9:73272NdsDr1
Source: /lib/systemd/systemd-logind (PID: 6285)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6285)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6285)	File: /run/systemd/seats/.#seat00PSGFs
Source: /lib/systemd/systemd-logind (PID: 6285)	File: /run/systemd/inhibit/.#10dOdwp
Source: /lib/systemd/systemd-logind (PID: 6285)	File: /run/systemd/inhibit/.#1jqWeCt
Source: /usr/lib/upower/upowerd (PID: 6341)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6341)	Directory: <invalid fd (11)>/..
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:74877UakPvP
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:748844JTa5M
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:74892TrvdmQ
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:74893bozYrN
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:74976cNtrgP
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:75917KW6LMO
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:75918eJnmzN
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:76025RuwRtP
Source: /lib/systemd/systemd-journald (PID: 6409)	File: /run/systemd/journal/streams/.#9:76137Z4UtZM
Source: /lib/systemd/systemd-logind (PID: 6415)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6415)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6415)	File: /run/systemd/seats/.#seat0b6owog
Source: /lib/systemd/systemd-logind (PID: 6415)	File: /run/systemd/inhibit/.#1orxE8i
Source: /lib/systemd/systemd-logind (PID: 6415)	File: /run/systemd/inhibit/.#1FNLW2e
Source: /usr/lib/upower/upowerd (PID: 6471)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6471)	Directory: <invalid fd (11)>/..
Source: /usr/lib/policykit-1/polkitd (PID: 6544)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:77064ECSHDu
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:77068dzsR3v
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:76483Kb7DEu
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:764840lQxDs
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:76491LHUK1v
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:764929SfBbt
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:76493rFpwts
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:764945wufGt
Source: /lib/systemd/systemd-journald (PID: 6550)	File: /run/systemd/journal/streams/.#9:765292bIGIv
Source: /lib/systemd/systemd-logind (PID: 6555)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6555)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6555)	File: /run/systemd/seats/.#seat0zK0ZCT
Source: /lib/systemd/systemd-logind (PID: 6555)	File: /run/systemd/inhibit/.#1XHG22R
Source: /lib/systemd/systemd-logind (PID: 6555)	File: /run/systemd/inhibit/.#1EiIlWS
Source: /usr/lib/upower/upowerd (PID: 6611)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6611)	Directory: <invalid fd (11)>/..
Source: /usr/lib/policykit-1/polkitd (PID: 6671)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78897aYBHv8
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78898Zu8rh7
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78905nhSrT8
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78906oB8BJ8
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78986lksrY8
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:789874TxpM7
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:789887zVxz8
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78990azqNZ6
Source: /lib/systemd/systemd-journald (PID: 6691)	File: /run/systemd/journal/streams/.#9:78998ubyR2a
Source: /lib/systemd/systemd-logind (PID: 6696)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6696)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6696)	File: /run/systemd/seats/.#seat0J5hvIv
Source: /lib/systemd/systemd-logind (PID: 6696)	File: /run/systemd/inhibit/.#14O93jy
Source: /lib/systemd/systemd-logind (PID: 6696)	File: /run/systemd/inhibit/.#1cSZJew
Source: /usr/lib/upower/upowerd (PID: 6753)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6753)	Directory: <invalid fd (11)>/..
Source: /usr/lib/policykit-1/polkitd (PID: 6810)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:797230RE2hZ
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79724kDtRDW
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79733Io1IBY
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79734LnlAdZ
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79741QVuUEX
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79742TLGPhZ
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:797431g690W
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79744635S2X
Source: /lib/systemd/systemd-journald (PID: 6834)	File: /run/systemd/journal/streams/.#9:79872CynliV
Source: /lib/systemd/systemd-logind (PID: 6839)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6839)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6839)	File: /run/systemd/seats/.#seat018Lojj
Source: /lib/systemd/systemd-logind (PID: 6839)	File: /run/systemd/inhibit/.#19vT1vi
Source: /lib/systemd/systemd-logind (PID: 6839)	File: /run/systemd/inhibit/.#1gj71Wi
Source: /usr/lib/upower/upowerd (PID: 6892)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6892)	Directory: <invalid fd (11)>/..
Source: /usr/lib/policykit-1/polkitd (PID: 6955)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80612IYDzFC
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:806190jzh7A
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80620RzcDfA
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:806993wJ9pC
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80700skAyxA
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:807013kXYBA
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80703PpTo8z
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80704YcklaB
Source: /lib/systemd/systemd-journald (PID: 6975)	File: /run/systemd/journal/streams/.#9:80712m7OCyD
Source: /lib/systemd/systemd-logind (PID: 6981)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd-logind (PID: 6981)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6981)	File: /run/systemd/seats/.#seat0e9I3y5
Source: /lib/systemd/systemd-logind (PID: 6981)	File: /run/systemd/inhibit/.#1xMwX22
Source: /lib/systemd/systemd-logind (PID: 6981)	File: /run/systemd/inhibit/.#14MLwM2
Source: /usr/lib/upower/upowerd (PID: 7037)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 7037)	Directory: <invalid fd (11)>/..
Source: /usr/lib/policykit-1/polkitd (PID: 7092)	Directory: /root/.cache

Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3760/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3760/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3761/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3761/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/1583/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/1583/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/2672/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/2672/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3759/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3759/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/246/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/126/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/5/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/5/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/247/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/247/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/127/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/127/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/6/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/6/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/248/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/248/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/128/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/128/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/7/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/7/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/249/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/249/cmdline
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/8/status
Source: /usr/bin/pkill (PID: 6273)	File opened: /proc/8/cmdline

Source: /usr/bin/gpu-manager (PID: 5864)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5866)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5868)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5870)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5872)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5876)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5878)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5880)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5991)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5994)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5996)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5999)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6002)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6004)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6008)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6010)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6122)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6124)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6127)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6130)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6132)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6136)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6138)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6140)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6252)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6254)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6257)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6262)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6264)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6266)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6268)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6270)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6382)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6385)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6389)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6392)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6394)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6396)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6398)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6400)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6514)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6517)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6520)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6522)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6524)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6526)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6528)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6530)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6656)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6658)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6660)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6662)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6666)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6672)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6677)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6679)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6797)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6799)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6803)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6805)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6811)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6816)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6818)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6820)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6938)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6940)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6942)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6944)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6946)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6950)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6959)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6961)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7079)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7081)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7083)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7087)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7093)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7098)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7100)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7102)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /bin/sh (PID: 5865)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5867)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5869)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5879)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5881)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5993)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5995)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5997)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6000)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6003)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6005)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6009)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6011)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6123)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6125)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6128)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6131)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6133)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6137)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6139)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6141)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6253)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6255)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6258)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6263)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6265)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6267)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6269)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6271)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6383)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6386)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6391)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6393)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6395)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6397)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6399)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6401)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6515)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6518)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6521)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6523)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6525)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6527)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6529)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6531)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6657)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6659)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6661)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6664)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6667)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6673)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6678)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6680)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6798)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6800)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6804)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6807)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6814)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6817)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6819)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6821)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6939)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6941)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6943)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6945)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6948)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6951)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6960)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6962)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7080)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7082)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7084)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7088)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7094)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7099)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7101)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7103)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Source: /usr/share/gdm/generate-config (PID: 5883)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6013)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6143)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6273)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6403)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6533)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6682)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6825)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6966)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7107)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /usr/bin/xfce4-session (PID: 5640)

Rm executable: /usr/bin/rm -> rm -f /home/saturnino/.cache/sessions/Thunar-2692b1019-2e62-4110-a5da-30fefabc5610

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5760)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6019)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6149)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6279)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6409)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6550)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6691)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6834)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6975)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 5861)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5762)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5762)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5863)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5950)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5950)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5990)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6080)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6080)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6121)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6210)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6210)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6251)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6340)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6340)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6381)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6470)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6470)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6511)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6610)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6610)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6655)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6752)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6752)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6796)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6891)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6891)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6937)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7036)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7036)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7078)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fqkjei686.elf (PID: 5570)

File: /tmp/fqkjei686.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5863)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5990)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6121)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6251)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6381)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6511)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6655)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6796)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6937)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7078)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pkill (PID: 5883)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6013)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6143)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6273)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6403)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6533)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6540)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6612)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6682)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6791)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6825)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6931)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6966)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7038)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7107)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5580)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5581)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5582)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5583)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5634)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5635)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5638)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5641)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5644)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5645)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5646)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5704)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5760)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5762)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5861)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5863)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5889)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5950)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5990)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6019)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6080)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6121)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6149)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6210)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6251)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6279)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6340)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6381)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6409)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6470)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6511)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6540)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6550)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6610)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6612)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6655)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6691)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6752)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6791)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6796)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6834)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6891)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6931)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6937)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6975)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7036)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7038)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7078)	Queries kernel information via 'uname':

Source: kern.log.83.dr	Binary or memory string: Jan 2 01:09:53 galassia kernel: [ 152.165454] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi scsi_transport_spi mptscsih vmxnet3 libahci mptbase
Source: kern.log.83.dr	Binary or memory string: Jan 2 01:09:53 galassia kernel: [ 152.165481] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: fqkjei686.elf, type: SAMPLE
Source: Yara match	File source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fqkjei686.elf PID: 5569, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: fqkjei686.elf, type: SAMPLE
Source: Yara match	File source: 5569.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fqkjei686.elf PID: 5569, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	3 Scripting	Valid Accounts	Windows Management Instrumentation	3 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fqkjei686.elf	39%	Virustotal		Browse
fqkjei686.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
fqkjei686.elf	100%	Avira	EXP/ELF.Mirai.Z.A
fqkjei686.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fingwi.cardiacpure.ru	178.215.238.112	true	false		high
fingwi.cardiacpure.ru. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.337.dr, syslog.83.dr, syslog.235.dr, syslog.453.dr, syslog.391.dr, syslog.137.dr, syslog.507.dr, syslog.567.dr, syslog.285.dr, syslog.187.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.238.112	fingwi.cardiacpure.ru	Germany		10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
178.215.238.112	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Mirai	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	wev86.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Mirai	Browse
	wev86.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	qbfwdbg.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fingwi.cardiacpure.ru	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
fingwi.cardiacpure.ru	fbhervbhsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vevhea4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jefne64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	vevhea4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	ngwa5.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	fbhervbhsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wev86.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	jefne64.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

Download File

Process:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5128
Entropy (8bit):	4.457618060812407
Encrypted:	false
SSDEEP:	96:R14GBdYLSNUH+ZAFQrSRR6dn0tWlTDFwIfM/vfzPpjT9I3jZ/qeH2Wg:74GnYLSNUH+ZAyrSRRYn0taTDKIfMPzv
MD5:	2A2A7C34B585CDAE5E123F3C5100C253
SHA1:	E814B1B1531B25581DB76CB813C85E53E1390BA4
SHA-256:	BCA18B654D038B69B25ACDF84CFF99BF521A1B54F482F1DE2B54CE13AC219A04
SHA-512:	CEC7A3A7A6AD6C2A6D101A3BF6D89A01EBDCEB0121AA3DE1CEA024268410B39E4E9188382439C7C3FD734C66764B66B13F1D277700B00A2FCB35CB67E31996DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<channel name="xfce4-panel" version="1.0">. <property name="configver" type="int" value="2"/>. <property name="panels" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <property name="panel-1" type="empty">. <property name="position" type="string" value="p=6;x=0;y=0"/>. <property name="length" type="uint" value="100"/>. <property name="position-locked" type="bool" value="true"/>. <property name="icon-size" type="uint" value="16"/>. <property name="size" type="uint" value="26"/>. <property name="plugin-ids" type="array">. <value type="int" value="1"/>. <value type="int" value="2"/>. <value type="int" value="3"/>. <value type="int" value="4"/>. <value type="int" value="5"/>. <value type="int" value="6"/>. <value type="int" value="7"/>. <value type="int" value="8"/>. <value type="int" value="9"/>. <value type="in

/run/systemd/inhibit/.#10dOdwp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.090645391357815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifhW0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfzApLHK7wR9n
MD5:	B17448514866D2B58F98FAAD3885DBFC
SHA1:	1BC96ED70BD654AA3436388C3D8907733AA152C2
SHA-256:	B84D5B2C485A02BB06846A6CBFB2510654245D58D8121987EBC8A17A0EB155CE
SHA-512:	04ADD5404BBB6F86969223C3408F6AB9B87626E2A39740008A20F972FC95C5E800210E8017B185B062D6C5A9DAD273787BAC6069D349ED945246672C65CCA4CB
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6211.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#14MLwM2

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifa3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfkApLHK7wR9n
MD5:	B1BF18FD6B27609721148ADF7459097D
SHA1:	0BB73316FD13A30F26DEEDDA8C9AA40E8C60A5E3
SHA-256:	AF71C582A95A2F2E838565F0C3B99EE443F2B326B675E910C1BBBAE2593F6A80
SHA-512:	91774DF9E6F96DE1CE726572278787F9089D9DD5B9BC9182949755952C3DE8F3673E308C4543E23974479D859A3C01C037AD7B641DE690A30F81F55B4159D146
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=7037.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#14O93jy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.076659377371801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9if/IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf/ApLHK7wR9n
MD5:	230A851C91BBBB50569012A1FEC3D369
SHA1:	B11B12A28A9CF6B0B86FD97E803FA577851222C0
SHA-256:	782C8202926005B1B6E3F00D7C7F8D75852CBF19E91988123AFCBA969F5D5A35
SHA-512:	3DE694744C13EAC2EAF6C19E3FA96D0F7B1A8474F51DAFF2366F69BC44A7B736496ABA4EBA38C08AAC030FDAE65AF3BDD48837FF3061DD5056E7663BF14A92EA
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6611.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#19vT1vi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifuvJIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfgJApLHK7wR9n
MD5:	78296F7F3B4BCB726764696422C9E4D3
SHA1:	3A8EE560B08F8CF6928EC06B2886E5AD0AFD2C02
SHA-256:	514B80328A6593A6AC1EE10836C0EF50362AF023AFA0FE3424038AF5CE3DC453
SHA-512:	B6C573229E315171770DAE5D77AE6EFF5476C24999C03B280A56ED68CC1CD4123FD918F50CFB1A87690494058574CF32D2B4E91C2FEC0617EEE78B07F456C1B2
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6753.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1Cbk65d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifbt0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfJ0ApLHK7wR9n
MD5:	AD5B1FD3E6DDFAC19299F3761C7460E9
SHA1:	CF38E70A5162477FE8496B0C01722667B4E19352
SHA-256:	E431CCF5978E605E21D6291D40F4F3D9115D4B4DFE5EAB1C3810337280031F26
SHA-512:	0E60CFDF17B3E7979C6103AB49BCD7DE75D3B499783572D272D6D953B14E695B04A8A967149F6E6775396E91BD5FB9D6C1C60D578E87F0A039FDADC277B2EE45
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5763.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1DzHbwW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifbt0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfJ0ApLHK7wR9n
MD5:	AD5B1FD3E6DDFAC19299F3761C7460E9
SHA1:	CF38E70A5162477FE8496B0C01722667B4E19352
SHA-256:	E431CCF5978E605E21D6291D40F4F3D9115D4B4DFE5EAB1C3810337280031F26
SHA-512:	0E60CFDF17B3E7979C6103AB49BCD7DE75D3B499783572D272D6D953B14E695B04A8A967149F6E6775396E91BD5FB9D6C1C60D578E87F0A039FDADC277B2EE45
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5763.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1EiIlWS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.076659377371801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9if/IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf/ApLHK7wR9n
MD5:	230A851C91BBBB50569012A1FEC3D369
SHA1:	B11B12A28A9CF6B0B86FD97E803FA577851222C0
SHA-256:	782C8202926005B1B6E3F00D7C7F8D75852CBF19E91988123AFCBA969F5D5A35
SHA-512:	3DE694744C13EAC2EAF6C19E3FA96D0F7B1A8474F51DAFF2366F69BC44A7B736496ABA4EBA38C08AAC030FDAE65AF3BDD48837FF3061DD5056E7663BF14A92EA
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6611.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1FNLW2e

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifZyeIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfTApLHK7wR9n
MD5:	D76E0099FF571768B3B1A4C7D7F61D1A
SHA1:	A902225578A266E2FB4AC4F9D5195D0D4BB1996F
SHA-256:	F54E594C1DCEE48BE620DB63AD80812498C7FF332C0FE102C9761414A06401A3
SHA-512:	09615E746DD3B9979D9C24DF10FDB9891DDC9B757093886AD08D07E8294E22C1969D3B885B5E5BF667EEFE4F0E107FFD14BE1FEE9C5B252E520C8D56F28825AE
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6471.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1Ga10RV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifLqY3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfLqeApLHK7wR9n
MD5:	7FF8489E583749A3C1D5FBA6DCF78894
SHA1:	5DD8DD340E4E43A36E8D19C5C88971A6CFE86B4E
SHA-256:	001470D6CEEE7A30DABE19A73912ADE71BDAEC572F6AE0638F41857D3EBC620A
SHA-512:	12D13537F1A0A334F58C287BBCBFABE5A5305EAF3107F425B7EB808D444110A39332BF1A2233EF4CCC49CA0E9D724A419B8C5264B0B11DAEB33524737923EE7E
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5951.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1LpVZOA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.090645391357815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifhW0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfzApLHK7wR9n
MD5:	B17448514866D2B58F98FAAD3885DBFC
SHA1:	1BC96ED70BD654AA3436388C3D8907733AA152C2
SHA-256:	B84D5B2C485A02BB06846A6CBFB2510654245D58D8121987EBC8A17A0EB155CE
SHA-512:	04ADD5404BBB6F86969223C3408F6AB9B87626E2A39740008A20F972FC95C5E800210E8017B185B062D6C5A9DAD273787BAC6069D349ED945246672C65CCA4CB
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6211.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1XHG22R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifZyeIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfTApLHK7wR9n
MD5:	D76E0099FF571768B3B1A4C7D7F61D1A
SHA1:	A902225578A266E2FB4AC4F9D5195D0D4BB1996F
SHA-256:	F54E594C1DCEE48BE620DB63AD80812498C7FF332C0FE102C9761414A06401A3
SHA-512:	09615E746DD3B9979D9C24DF10FDB9891DDC9B757093886AD08D07E8294E22C1969D3B885B5E5BF667EEFE4F0E107FFD14BE1FEE9C5B252E520C8D56F28825AE
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6471.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1YY3eNN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifLqY3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfLqeApLHK7wR9n
MD5:	7FF8489E583749A3C1D5FBA6DCF78894
SHA1:	5DD8DD340E4E43A36E8D19C5C88971A6CFE86B4E
SHA-256:	001470D6CEEE7A30DABE19A73912ADE71BDAEC572F6AE0638F41857D3EBC620A
SHA-512:	12D13537F1A0A334F58C287BBCBFABE5A5305EAF3107F425B7EB808D444110A39332BF1A2233EF4CCC49CA0E9D724A419B8C5264B0B11DAEB33524737923EE7E
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5951.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1cSZJew

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifuvJIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfgJApLHK7wR9n
MD5:	78296F7F3B4BCB726764696422C9E4D3
SHA1:	3A8EE560B08F8CF6928EC06B2886E5AD0AFD2C02
SHA-256:	514B80328A6593A6AC1EE10836C0EF50362AF023AFA0FE3424038AF5CE3DC453
SHA-512:	B6C573229E315171770DAE5D77AE6EFF5476C24999C03B280A56ED68CC1CD4123FD918F50CFB1A87690494058574CF32D2B4E91C2FEC0617EEE78B07F456C1B2
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6753.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1gj71Wi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9if8vV3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf8vJApLHK7wR9n
MD5:	A4ABFAD5CCD9E45E48365AA9F706E29C
SHA1:	CFD83A7BB153DD6D24CE66A77271C7735E227E1D
SHA-256:	845DD8FD935868E7CA9F3C48903E39E5CC80142FFA225D8637D735CDF294EE84
SHA-512:	FD88CB43DB6CC3C9A66A4CC8EE129DABB6C90F057FB97D94A958F210EF35E43C0BA46D87EB1E6B76E6DCF3AC85D799DC3359E04FD500EA709B062027E67C2881
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6892.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1jqWeCt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9iffvytjAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApffvyt0ApLHK7wR9n
MD5:	784107E4962AF0FB760D21D36025C60B
SHA1:	E3085EB3B4655DB51D693AED62D957DDCD3FE7C8
SHA-256:	A1ECFF83DAB44652FFB4CAB9DFA3B3C322A6E211EA6EFDA4873007C708762EF0
SHA-512:	6CFFE4AB0A0F02C86FDFD0CE2A3BD6B83BBBE5129464C797BD380C7CE3296FC35DC21F968E6F2EBA3583A1BEAB73A5B7EEDB91118FD4BC2B6DF6BAFC721A6427
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6341.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1oUoPvM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifht0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfheApLHK7wR9n
MD5:	BC6BDAEB56A79AC2CA296DC9667B5B12
SHA1:	D80C3044D4F928851DF760D61CDAC9DE26032E6F
SHA-256:	B6334AF1AB262975B085B5CF72CD17038EF0AE234EA40528F68FF184A3D57FB4
SHA-512:	881DD65CAF978EC3A5CE69AE8D5FC006C68750A2EAE8E13D946D893786A38645B2A1770423C03138BBAFDF7CE1FBA8873DA8C832CF9CD8BC98210A9CF314BF20
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6081.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1orxE8i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9iffvytjAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApffvyt0ApLHK7wR9n
MD5:	784107E4962AF0FB760D21D36025C60B
SHA1:	E3085EB3B4655DB51D693AED62D957DDCD3FE7C8
SHA-256:	A1ECFF83DAB44652FFB4CAB9DFA3B3C322A6E211EA6EFDA4873007C708762EF0
SHA-512:	6CFFE4AB0A0F02C86FDFD0CE2A3BD6B83BBBE5129464C797BD380C7CE3296FC35DC21F968E6F2EBA3583A1BEAB73A5B7EEDB91118FD4BC2B6DF6BAFC721A6427
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6341.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1r4LBXz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifht0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfheApLHK7wR9n
MD5:	BC6BDAEB56A79AC2CA296DC9667B5B12
SHA1:	D80C3044D4F928851DF760D61CDAC9DE26032E6F
SHA-256:	B6334AF1AB262975B085B5CF72CD17038EF0AE234EA40528F68FF184A3D57FB4
SHA-512:	881DD65CAF978EC3A5CE69AE8D5FC006C68750A2EAE8E13D946D893786A38645B2A1770423C03138BBAFDF7CE1FBA8873DA8C832CF9CD8BC98210A9CF314BF20
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6081.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#1xMwX22

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.123896352911406
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9if8vV3IppTMXSHK72X8/Sf9n:SbFuFyL8OAApf8vJApLHK7wR9n
MD5:	A4ABFAD5CCD9E45E48365AA9F706E29C
SHA1:	CFD83A7BB153DD6D24CE66A77271C7735E227E1D
SHA-256:	845DD8FD935868E7CA9F3C48903E39E5CC80142FFA225D8637D735CDF294EE84
SHA-512:	FD88CB43DB6CC3C9A66A4CC8EE129DABB6C90F057FB97D94A958F210EF35E43C0BA46D87EB1E6B76E6DCF3AC85D799DC3359E04FD500EA709B062027E67C2881
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6892.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/journal/streams/.#9:69362IYf4FL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.562672166929002
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7ASv/EAXfykX0Mxs+:SbFuFyLVIg1BG+f+McSv/EDZji4s
MD5:	C7CBDC1B309163296FD9BA778F6425F4
SHA1:	784E8573EA8CDE44E0D94BE29A7078D5EFA74A56
SHA-256:	D91996D10D415DD8153E351F26F2C77AD81CD3EA41B061432E8B5559636CBF94
SHA-512:	5269DDFD979FA977D6C3454C247E5E8CFAF43F1DB8B90394788918577A71A9F0CB7157BC71FB06B0E7981AEF01289C259EF680F6E6D61C793DC4421518CE9798
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=125767b2aedc48d5934fb9421c623d72.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:69368kSli0K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406939068405587
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8HRtYWB2js1HadmQ9:SbFuFyLVIg1BG+f+M8HPYWAjosQu
MD5:	8DCC6426E11F91D6179EE49950536C46
SHA1:	144544567EA38694BDE1AE2EE9F3C6079BD72209
SHA-256:	33B81A7AE800294F96772AC1213BA79E9F7500EB921035EFE44B25C2FB07343C
SHA-512:	7BF4C036CFA49DEE3191C29D36BF467120CC3A56D3B88BBBE29440A67C3479C9A745C4711847E181582D96D47B9C6E0C371523BBE28F9303B9F98BF358F1BB3C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b4a0d28aeb14b829021be33bb766459.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69369yCe4kM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.355556817235232
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrXLdhAoUsjshQJWL0:SbFuFyLVIg1BG+f+MHL11jtWL0
MD5:	EE9706FD2B5FE2AC15A23C3CDDB432FD
SHA1:	83266D74B5FFF3092282B01D7C487546E4E95218
SHA-256:	EC9AFCF820426722ADDBDE9FA59FC8DEA95658B40F646802C02BCBB504A0855F
SHA-512:	6609043840E54537A65E4128B37D9B6002995DDBA46DBDF4E146D79B89660DCC8AE5B5EF195C5065D9BA40E628405C8044EB6E3C9D21EC6338E406ADF1342755
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a56ef26472134904a13054762bf2fe8a.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:69370aOeSpM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.386791024518439
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo8p+mJU0jskGp/:SbFuFyLVIg1BG+f+Mo8nU0jfGt
MD5:	ACA6FCB56E77B61354625145CDD685F8
SHA1:	2A3B736923E85D178A1414D983B40341C7833E9D
SHA-256:	E4A752B9EDE733B50BE19050C552838D201E4987E5EFB556E9EB0EE0E04AFB6B
SHA-512:	E76F7CBC0DBE7E06EEE9E4F6C7770E221DF545A741DF943A0927BF070FDEE41B92AB173B2317E18686163BA79ACAB19FBB7B94A3A3A6BEC29C735AC745942E58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b1aefe55f6ee425d9d28f7805ce250cf.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:69371oOCXTJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.364178747468821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4HEt+d26kWXqjs1Ha:SbFuFyLVIg1BG+f+M4HEtM2XW6joa
MD5:	51D806D9EC92106C28DB2C64DCB6E4C3
SHA1:	4070698185800FF96C7BA54E61A7D4206CDB29C9
SHA-256:	CF0B414AB5DF97CE6185DD137A5C1F2FAF077735E284C6E447F12BE345498F8C
SHA-512:	4CB8AFCD212E3935CD655A2658D55527F9D2C4963E5B775F4D282D235214A57657978358B25788A27766477E1E50E6D15D66103B3ACA0298E2C523488C8B26E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ba2578a24724696836d88750bdb342d.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:69380tVYqJK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.402607682162885
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuLQKBzmeyqjs1Had9:SbFuFyLVIg1BG+f+MuLQ+a0josQu
MD5:	894113BBB3595A9DDE10789D8FDE391B
SHA1:	83068DDBDD4DA38C026031F92FDBCE6C50B5411F
SHA-256:	65B72F076CE974962DBDBD68175C3AFF477E355DB2A1862A7EBC7801BF77F7D0
SHA-512:	3420E7861380605DBCB792A13DB742D66D71C7B9E8B8E6407993FB5D3051E94F1357DDA206C2D72E657B3A212711CA897AD07D0C3BB8ED30D630A83023FF92D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d5cb585eeca84253849cd6c57cda0516.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:693817tKKdM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3966700006806
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmztBXXBTrTGl/jwRLD:SbFuFyLVIg1BG+f+MHBfTajs5josQu
MD5:	429527DF545E4C0D389D3C32C20B6851
SHA1:	6CC781F852F1BB280A9E4B2DEFE95EDFE98D633F
SHA-256:	9A97A5611D08B514D6A27C381C60802D6817348EF7897C98D8D426BABF7B521D
SHA-512:	81AEA439C9C58BFCD8FA1C5A53D6CC938EE4955ABAF9EE3021F1375195C2F900D965053FBB1B975FA62FBF7DAF9FEE67A9F2489BE8607863E1EE3AED6FF941CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ec4d22d6b9146c3bea3c926214146a5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69382fn4KEK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.384471135699071
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9vlDgEOzZjskGp/:SbFuFyLVIg1BG+f+MnDSjfGt
MD5:	7AFC3BCAD76F555457AA17A43D4A3C18
SHA1:	C255D923494C2069FF89B1269EC6AC2E5F06306A
SHA-256:	B01CB2CDC08DDF38DC955F9C6FF4A75EAF390D8AE5BA08A0F7FD45F53D1E259B
SHA-512:	6601EF98E09FC9C6A93ACD74C080AACCB8E0515ABC318F30B56097C9E22CE37BC6F304715D72B452F7A03ADD9298F4D415E9E27215839541CA5C4726517B5AB0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7e7657ffe9c04cd29d0f122ea72376f9.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:69389W7ZbZL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4767009908567035
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsEDUHBlTjZcHcljX+:qgFq6g10+f+MsEUHB3mAu
MD5:	18556E60838DA53D0AC9D2B9DF972A40
SHA1:	49545A7E4EB8BBBCD3812E3E6EE8AAA3F89C1545
SHA-256:	058AA8166C5458DD9D096F767E3A075048A7AF63B5542FE3289378C0D7DD0463
SHA-512:	1B6068E075A7F5B9CCC2BBAA39F623EB4E3687FFFC76672664F4C7D18C8B89DEA8D7C9CFBDF664698771FF3F72A7E9E959802F38B5817045ACCA4BB2D060FA82
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f543d6e284774ae9bd09603fea98ea71.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:693902GYUKJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.397978507535144
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7irTVmidQ8Zjs2ALAXA:SbFuFyLVIg1BAf+MuFBZjNALyAZD
MD5:	9318BB2478FC87F5A602554A08B3D5B8
SHA1:	4FD34C86BF25B14CDBB626DE9C38F0328B049C50
SHA-256:	86E7732BD2630BB51611E1086FA10102073D02329EF82E98F35337C8F68781A7
SHA-512:	FE9793E8FD06224E82C4B7AAE78D915AEBBA42A43FA3BACEF7E1A53B0927F489BA8FDB13664AA8CCE878390703604720C8D0F9587B84D4DEA773C6FBC3741A4B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14a6ba4503104364a15ddf65eeba0b87.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69411b6pXkM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4556708997105225
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MocRL49bBUm2jNdQIeXD:qgFq6g1af+MocRL49OmM2D
MD5:	5D185DC625C9DFC7AB139B068041717F
SHA1:	C6EE1F46B5D7313522431EFE07B51E7162138DDE
SHA-256:	5A15EB4CA1676C87A2B2A16E0B7880B1D5E231481A4E52257C4AE26A65FD17B3
SHA-512:	BC87A38DEEEE362CAA4BD171D5B7CCC0ABA21C7F4174E66DB28844172C991319158C7B24E225D566A44E81F022E47E46DA95B123EF31ADD49CE167AE762F8CEB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b71652d22e474a16aa11d6868cd12984.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69944EJpfKJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370834999018105
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpYSMMcPjswkClrTq:SbFuFyLVIg1BG+f+MWSMMwjLkGq
MD5:	E2151BD321687C64438C6436D931E154
SHA1:	F2A42BA95AFA0839DC0ADD6541023997663F7748
SHA-256:	34CD84B270A467516925DAA6D88DBB63C19EA3B836B33F8356068CB886F42CCC
SHA-512:	FC57C52F34BE7378678129AEA354539354EDBD2B012FD66151BDFCB9910BB0491B85A0BAACBAD9E7873CDB7006ADE516FF40D5C0DA4B8F48DEDBF281B4E25EE4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7827634ab7b463aa2dbd2b2e60a90b7.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:70539HdlpGv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.402887181732788
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpyNDVSQQGCEvsjs16:SbFuFyLVIg1BG+f+M2D9H0josQu
MD5:	F09C0012B12AAC979F5E258EE6576CB8
SHA1:	99CCEC1691D1868E28A9BB8903B52B15245FA252
SHA-256:	D91A849D7326D6C36048AD16474FC6C4C6BE93F331402AAB39438918C6AC0923
SHA-512:	FA1A45A7A3D057483E1DB9B884E27ADCAD6F9D488647F294AA6BB40F4613B7C062281130951FDD2C49349D8905FB67C6CE6956C7A6319C3906ED14789AA70016
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cfef9dce1bf0415d8ea5852f298c951a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:70548sVwsHu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.517140067912339
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MUNBMPXlN2jZcHcljX+:qgFq6g10+f+MUNW1NYmAu
MD5:	45314D8DFE75C34AD70E525202DFEFF8
SHA1:	0F38989994F258942F0EB28994B5130D40AD5696
SHA-256:	B34863BB1B21E887F789CF5E9D58D305371FE5E0F2A32422F87E5E558B39BE45
SHA-512:	EFF9432488E8B30BB391739125C9A2E6EDA1607FA4F2FF2478B4178C1C6F483C6A51BDA9EDF34003BDADF72EA8BF0CD3292E15E805F31B25DCFE5A85947881F1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=156c9b970b914b8fa677b2e3fb8043d9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:70555sFOgtu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.433929503930376
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4EcggMLXOGxMxsjsf:SbFuFyLVIg1BG+f+M4EgcOSMqjfGt
MD5:	353D5C3AE992F6FF32473818487042B9
SHA1:	73D474948F2FC9DEB661A7C765540F6F9125D906
SHA-256:	141311A095C135B25FBF7EC0AB37FA884BA0D15521D28B5603C060F45C61A3DD
SHA-512:	1480A9137F4703341745953C5FD5EE541C21CCB9D363D0B61E19BCD0C5E60429BB3F566A99ED91E21A89E2F00FCABC363EFAEFF9B26DC6D52D464108F4E16721
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=234b0179be6845fcbbd82f333c6e91c3.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:70563dq5rlv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.419457405722376
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4TGRdjcC7YuFlsjs2Ax:SbFuFyLVIg1BAf+M4qEC7Yu8jNALyAZD
MD5:	36EA54AA0E7087F8D1F0E24B2C4C573A
SHA1:	B2D3F3097EC74E8FFDF308C963E9A8D970F4B46A
SHA-256:	920C933C00BC1A86E862838734133B159DEA04F7B3EF61662B2CBA9F19B96903
SHA-512:	E1CB157CA01412176085F600FB61CE1DC08DFC833AEFB37D88AA197C08A4E1C74343070FED4CBD71514545223B9F1D86280C5E151D5106EF3DAC7903BA90D5E6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=29cd0b3d46f848d09c004fd7d907fac1.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:70644CmhpHs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481200861548972
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvM1pfLHTjGWAuGG2jsd:SbFuFyLVIg1BAf+M6TjGWA62jNdQIeXD
MD5:	12A09BF3EEC4D6CA7A1C29574960C87C
SHA1:	EE3513399F7CF34A1D0457B7AEDAD6D19A316935
SHA-256:	15C4B2007C95A7E864FBD4DC52A02AB7F585C82B0C15001C8F1E261490C58ABF
SHA-512:	34147ADFBA3C5130B640B1DDF935062478A6901B0799510B99B2B9D722B32591B1FC71C96E715608E12A6AD1B2D6F3DB62ECA09CBA9AB474E487F387D501546F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e8b01394c63b4ffc9b675c3e7d5af56e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72103YqXgui

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4114725994790485
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuX9RXSNI370h+sjsc:SbFuFyLVIg1BG+f+MuX0hTjosQu
MD5:	9D2106F4CB866C2092B2BF6295BF822B
SHA1:	99922284DA66724A89024A9DE1C2C1F90943B6DD
SHA-256:	B4EE2441B2799C486AF5AECC2D93A2402749FE092CB2680853EB215C0BB54ED9
SHA-512:	FB30FA2062176AD886E69E16D043C575451BAD07E40A24C46FC76B31FAE7A6A6778C9985B1BE5D511C00757B6714B00B490327EF493EA1C70661DA44452DA5FD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d036151a7271427186c7dd514c3dbb62.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72104omgWzk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.48187449936773
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MmWE49ZrqjZcHcljX+:qgFq6g10+f+MhEmAu
MD5:	DA15C89C94850BAB200711197B55E38F
SHA1:	D2B90530E5B82AF84CAD13CF1AF5B0F81A1F31EB
SHA-256:	5976A3D6302203049B16DFA7F68776C19BF9FA444E9545D10BF4964CE9D87CFA
SHA-512:	26BB7B801107B3FBA20DA7DD16889D5C602095FCBF8CED47FD49C334E864E0CA9C15973C11B80A81AD984483BFC0E2E7985F5368F9A560F48F9D3E60B686CEE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3420ab063aae482689a912e42f5a7841.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:72111bGXPYl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.418225694423675
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsQJKRl9QsMxsjskGt:SbFuFyLVIg1BG+f+MsQJKRly8jfGt
MD5:	E764BBF6A0C89CAE54C66D49F2BD1066
SHA1:	32569E05B5ADAA1469EACA5A3C5D8F3C07FA0A59
SHA-256:	E1C4F1C3FC9F33A35FA17129B0587888DA94B081B81C33B5EA55819695589C99
SHA-512:	EABA3954ECC869B0A436C7DD252320668162DEF5D0D541C041201F6661B2CB0E1DD810BFB904B2AE944DEC6C813C2FF3A8DECC64EAD2947290D42BE6D2F4CDDE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4e9a52690864be491c92d2bc97c4fc0.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:721197lFUMj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.43278824117375
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuOR+Wilsjs2ALAXaGKX:SbFuFyLVIg1BAf+Mut2jNALyAZD
MD5:	92949B152A9074FE12A1F17348731DA0
SHA1:	24261A9ED4F5214530571DC8791C5BA39F98AFDC
SHA-256:	2D4E7EE2F6A6FDC60EDD9B8020478747C043725DEB9BCDA97EA4E234D216971C
SHA-512:	8DA0AA4B91D12A45850686C98AC588118B02B3DE6A9ED34BB8313C6C7FDAC5A89F8AF7C3CFC83682F7AE4ED122C0EA4DF9C987370F35B02671E09372AD5339C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db507997d24d41e4929da7e5716c8701.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:7220224AsUj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.487773477415858
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmprBmk/KA+sjs2BbQIeT:SbFuFyLVIg1BAf+MXmJATjNdQIeXD
MD5:	57BC658379E34B32913EE6BA6B7A9A20
SHA1:	47DD7900FABDD8EB69F842DDECEA06D78320F320
SHA-256:	059F8621295384484FAA49964E2D41BCC294E4789426ABA30EB130DB77A17C18
SHA-512:	D458C99DB64B2DBF05CC4D861C44E333D4953D98018988BA784331B3464C4F6A842CA86B8E38F7FBD1D995E68B4117494EAEEA22D5636FC77E31891D5B5282F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4f278ee666943c1af5a5b52d2fa3773.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72741ViPbba

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.393036457011494
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmssGEqxB9+naxwsjsc:SbFuFyLVIg1BG+f+MsnXB9txZjosQu
MD5:	9AB2B6B1FA3B5416C35E3F11A3FBFB0F
SHA1:	AD57DAE27E2DF2ECEB084744E0DA5D0DA26D5A15
SHA-256:	282E2E512916C51474BB04F343259C867A6AD4EDF5646BC8F4796EB159944FD7
SHA-512:	8A64DE337E3CC76BC11C54A64545B465AF0053E15353EC9DE27E13326BA5D3D6D572747D86A7F72C99D768E40116A3D7441B95C65762A8ECF23A6ECE336CCF2B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f7b0cae26e7242d8a480bfcfa24dba63.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:72748GGS4C8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.490892624681351
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9bAG7op0jsicWmI2d:SbFuFyLVIg1BG+f+MKijZcHcljX+
MD5:	AC0719D8E5B53C0FBBF6253810E6983D
SHA1:	FEC5A9382C9BFF7521A476551B737B2853304DEC
SHA-256:	2154B9EF4694CA2EDDA93DEB4B43F6532454C6202030C749D615769466E4E9DE
SHA-512:	08533DC45D7D508EE5309738499F80A255E66787E20BC49117AFF373F0790B62761F2EDAE1404B5DA8A74C6F3DC311F8E37152CBD24122E918E47B9E7EBFC768
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7fb7eae94a164c7f920af58294196e09.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:727561nYxy8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.416730540831202
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmupcX9QQj6uqjskGp/:SbFuFyLVIg1BG+f+MuporWjfGt
MD5:	476D74BC6B2DD34DEF4F637EC80A84B1
SHA1:	3F67C05F4AF9F16252DDC86D5EAB988F16D5B1F5
SHA-256:	8A5647036C7E54FA064A41B8DAF77FD23B8D0CCC87DD6D44DBE9A7D5634E83B0
SHA-512:	9B8AE2F4EBDDA32A76EFED807283168994B8BDFFF3ADBB52F9DDB8B574F97B266C803065C8162FAA17CCC62100BED6C4662395B36A7402B427D1103A5CCB6518
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df598d92b8e946b9b6f2608a52afccff.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:72759jWAXM9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4291935387824966
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7jQEQdGLBciIgrxsjsx:SbFuFyLVIg1BAf+M5I7iIuqjNALyAZD
MD5:	B21A55231BA99E4960E79FA49CE80FF0
SHA1:	24B4995FEF358F5EEFD560D8FF829D5DBD16EFE8
SHA-256:	52BA31438709147CA514B1D473562ED137B5BE022D922BD7F60345C9DCFF7019
SHA-512:	A84E73F4EBFE6F2C92D9B89930C32BC4A93036B33413351E82904B1E8DE29D41F13376B7A4EF7296DE8FC4E45873F03DA51E968ED5B008B59983D948DF73F3FE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d05a328568a49e480ebafc252f3ec7a.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:72765QCFaX8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.463895248020995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4r5UAbCNR4w4Xsjs2BI:SbFuFyLVIg1BAf+M4dU66548jNdQIeXD
MD5:	C99C013379BD16BE5B27BD8E0D4A9EE1
SHA1:	198923C3FA3296DB8EE7F651C3558CB88F93A9EB
SHA-256:	78E1BFBB37564FBF504132509E2EF7BF1A4CA01C6F8F657FA6979F6CF055F454
SHA-512:	B8B8FF8851C7B279052F78E0506247FE7A13ACD982394679544A7A1896CE5E7F2116FE01A16B7CDCD6C857638A291B1C00327DA5043FEEC8F7D0FA6551A3C6A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20db768011e248b29730ac40394a49dc.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73180tkbPnY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.404179000424329
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6bhdAwcHU22josQu:qgFq6g10+f+MyCpiQu
MD5:	D822C89D5E62B1B65146427E61823A34
SHA1:	3E9254B3DF0C90B8B59BF507A3524BB61908CD0C
SHA-256:	5FDB9396AF4F85252B024EE994155DB9969136F8A5B614F4E68300953CAB2709
SHA-512:	80DFC11EAE43FB4AA7A79800F76477E9320D9A7E06D68A12DC53E5FAE56AC5E6D13173829F54EC2949BA587CECB44ED2BF4D5BD2343E8352C14EB79D927D4F04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00b2197e42d74ee8aeff541c8ed5b9bb.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:73187UaLDsY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.448225252190839
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm90cHXE0BcmWSy04Ti:SbFuFyLVIg1BG+f+MvE4hWtjZcHcljX+
MD5:	1F13CCD2B4B215E1C8ABBB059A8DCC1C
SHA1:	445460D7ADD1D6CBA3E50DC3DBA308E1CF997D73
SHA-256:	A8DD2A6CEA05CB5D52273935C5149B721A596929319AE4999EE8213C5836E5A7
SHA-512:	3B5ABBAC478A7DC1259D772777F9B0BA8EC0FBB5B86FF64E56F490FE8ED35F0402315EE12610043D1A3B1F3435D37F4251D677E29E27DEAA3CFE7E97BB16D1B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a0fb9beada742d9bc379f1e1be74237.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:731959kAh6Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4044570942720025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+iunGXClvFrxsjske:SbFuFyLVIg1BG+f+M+9nGa2jfGt
MD5:	38638698FC4DC48137F66CEA68826661
SHA1:	7F1D8745C68C46ED038DA50483C291341FA456C4
SHA-256:	01EEFA4CEB740D18A7CA6302600CF490BD11C27D2472D24AF6C5A5CE788E5BBA
SHA-512:	21FDD4940050135CFD823A37A0873CE5746893A104FD6B352B647143B4EC47442AA1D4ABAB55977BD0162242C271ABE84FE48991D93B04B0F8E5B477E5D682BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a2758bb08c24dc2a1d530ef9107210b.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:73196BamJ5Z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.429180472293646
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/gEdkRjSQCv2lsjs2Ax:SbFuFyLVIg1BAf+MY0gjNkZjNALyAZD
MD5:	EABE83B95FFD191C32657485DF1A9D01
SHA1:	B268F44F0464F4F6D4C8BE22FB51F58FD54AC261
SHA-256:	72573A9C1E8561A3D6433EFA606654B3F201AD75F0B5308982239AA6B30CCB65
SHA-512:	28580F4DF3033C2ABC5B5F1F4FE72D022EB46FC1A9922F2FE05C0E0857496EA06C2D11582140E51E48F789F416634BCFBFAE47C69B4BEC1977515A6A4AD9C1B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=576a8c2d411b4ec5b3284ef870e2141a.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:73272NdsDr1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.444176345507152
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7EzcPHEyeE602rqjs2y:SbFuFyLVIg1BAf+MI0HkE60ZjNdQIeXD
MD5:	0EDE0D7C2BFFEC7AD6FE3BB48B2A9589
SHA1:	3EB18B547ACDEDA043F70ADD03120D0A6E2BBF96
SHA-256:	2B63DAA8F6D13615E0C02619BFB7EA0034F7C2E573252D606362180E184DB045
SHA-512:	FBAB815DB30BD2055606DB2B9A32A96B570F7ADDC22B362115D7D0B6AD6F643FC1485637390CCE1E0637BE4AC04E04D229C49207CA59361E95BDD0AB73607A61
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1564dfe8dae3496fb93ab76b4aa85aaf.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74877UakPvP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.415804783205683
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MciiU/e0uqTvYg2josQu:qgFq6g10+f+MgU/cBDQu
MD5:	F58ABD9F3A521FD971B8382F43639BF7
SHA1:	DDCE7DE0F8FC31248AC19260BA4CCE520C8C00E4
SHA-256:	60F6A1D453DEBD3FCA40294CCBA6CFD0C10BD978163E78C3137D1BB662263024
SHA-512:	1325AEE04E7DB8F7A99885DDA4977EBDED80BEAA23BC3D4B690F6F0E2238D16C3D0F514E41957B93C0EE5B1726A3BBA3B4BC079D39A9E1B883C171F16AD6D8CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3a2ebeb12e4e4003bf5087b81426b9f9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:748844JTa5M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.490775208549702
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoXLiWVW6RqjZcHcljX+:qgFq6g10+f+MoOUkmAu
MD5:	2EABE1B4564F0D684B7B0985AB576C42
SHA1:	7A2745A9F82BCF5F3D7E32746EECF15FEBBF0FB6
SHA-256:	80A5951BEA7D279CD30323D4A35C6EFA63E440F9BB8AD04EEC1ADA2701D3CC71
SHA-512:	D84675FB1436A7F1B7452721DACC668BA5D352CD1E48BF7DEF3720A4C8723522D336A5A004DA22736DF1A6245D641EB1FC8BA95FF5BA95E2F92502ADC2DD76E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc9a342e963e4a22b3d8b98bed87f5c9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:74892TrvdmQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.402883025995739
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsHQlVzBfdHyvAgrqa:SbFuFyLVIg1BG+f+MsHQvFfQvRqjfGt
MD5:	3BDD29772F8DAA5B0B106A50DED7480F
SHA1:	637FA0A1FC42047E9A27A5DE2CADB7F598E48A8A
SHA-256:	B43551F3B249DEDC1FF749A74300505073D8523E393C765F7E3FA1AE1D85ACCF
SHA-512:	F37ED99A9890299EF2ADFCDAD44722B00B22C62456CCEEFC7381865666F3BB16E10029B88556CBFDDFC59773DA3301052541998EA045E033106A509F4E558240
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fb50b5c008424531bc39a908bbf25239.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:74893bozYrN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.432499667965995
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Ms6mDC9ihTjNALyAZD:qgFq6g1af+Ms6mD/nIZD
MD5:	9D7E608D3A6B857E0503FA9A44213EF7
SHA1:	B03B4ACA1269769B6C2286FD63594820E2AC521A
SHA-256:	786DDD8E0441CB4CCDF9382EEA0FB290A01403133A60D031FEA44F5ECC04FD9F
SHA-512:	F182B89C7E65D0D33CF7EDFAAD2C74212FF0F969EAE6E6C6C4C9F0604936B3985646D85C74C02FB15A45BE460FE02A50BDAB67B452186CF4B8DF5928C4680792
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f0b444c9af72428086033d32102a2b84.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74976cNtrgP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.484900951838671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzKinAAfLXGWh022js2y:SbFuFyLVIg1BAf+Mbv0ZjNdQIeXD
MD5:	83835F5425343710EF7FAAE404C9FB8C
SHA1:	B9A0C487A3F0E7A035CAE42DD3B86CB6CC061939
SHA-256:	1E0303518263E620C4E5A6CCB103655C24E52FEC31A310CA964FFCB2DF8769DA
SHA-512:	CB8551A603B4144E5078C655E2823A570EC2CF642FC91B0100FE1699CDB8530E16057E05AE0FEB0632F3119EFE1438CE4E7897E8B1D0E0E8DBFB80A662C2DAA0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9062d643a544479289c2eff1725637a4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:75917KW6LMO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.377782816214572
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9hBT/AkoEQHR0Zjs4:SbFuFyLVIg1BG+f+MPNAN5H6joa
MD5:	4F7085F3D56FA261FD4C92D8576C16FD
SHA1:	9C725D708BB16E8C3529632BDD09118B6188978F
SHA-256:	AF7DA5BC80C545467E7109A693E5030ABA34FE67673C8F078555AA4295EECBFB
SHA-512:	94C836D9566F0B3CB96A8A3A4D0A3C19E5FC31420D219164F6A4C179B0BF40191F0F91BC2D2F2E30FAE59DE3F17ECB808497358281FE1A62E35A5E43EFAAA310
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7c201d2759734a5f89c4455727eaa5b4.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:75918eJnmzN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.342003192731813
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzfA+L4AgrxsjshQJT:SbFuFyLVIg1BG+f+MTA+L4AgrqjtWL0
MD5:	498BAA24F68BB2889F5547CA8A318597
SHA1:	F4782DF0E1ACACDC9576953646CB52CB581C42A3
SHA-256:	0241667BC912B498720A1178194E4D057D160171DF218262E668F8D58D0C462C
SHA-512:	50E168244245C0C6ABDD47EFEBA90383746EB37C9125C3DC2F398097D7C1834E9CA95248AB26F85CE22F3C81011585FB976A7936E1E60EC8644BA350BF028A4B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=983ce8333f004f80a9efbf441327136c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76025RuwRtP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.430025622465889
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6qDQw4QYglsjsjOdy:SbFuFyLVIg1BG+f+M62Q5W2jNE
MD5:	D6C44107B7DA753350B679BB0566FE01
SHA1:	556D14F5F246C27F5C7194D288CB912125956BD3
SHA-256:	477C5D26E0CCA281F73067FDE32D6789C6CA0812360B855C9FA3C4DCDB964FBF
SHA-512:	E6111C97D1994D0BE2737AC1217FC98799452B5DCAEBDF78359A1BF7320443CBF4C02513C1DA5861D3E403ADA2C328920172EEFA41043E7DF5340F254E98AB01
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00f9fe5938124936a8d5d5bf6e855d63.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76137Z4UtZM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.440412262647169
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvlDkgJHkQn8sjshKe:SbFuFyLVIg1BG+f+MdvJr9jbVC
MD5:	DECFEF773A7B96786B11BC73ACD9B90A
SHA1:	249853F7A1F0CDEF49F8A519A8BF70B0CA277E72
SHA-256:	693E9B5DAF90C82A5C24B1AB707FBD3928E33AA2A10325705797381CD8EBFB0C
SHA-512:	5637FB2BE324E9F0DD0F0B4CD85504A2AD53834AD97E1291F8F4A905BA900455322E9173B94F4378E64809B84A8D914C05E8AC254CDC3D2A42EBBAA9DAECDC8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ebc7f793c1c34cf0b50de2462087589b.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76483Kb7DEu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4009007237685855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9BdWh+ZBbdSRxsjsf:SbFuFyLVIg1BG+f+MC+pkqjfGt
MD5:	B62F663E03355E0DBBC1BF3D160525DF
SHA1:	4B324C85F7FCF793B64F23754A11DBF32184571F
SHA-256:	4F4A6BAE920C6808DE354083B83D8AD2DF6512A4D2D5B5D6A71B5568E711F8BE
SHA-512:	5C40DBD35A5BD42F12058854D1334338CE899415B6655FF7164515E9E763017AFA3095B802BCB97E5A468A00422DC6C32BFCC37A461B427CCFF4F6F750A63AEB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ab8398361a34beb8df1c7d7cf8368f1.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:764840lQxDs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.386741123736228
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmswLb+iUmbh3juxsjx:SbFuFyLVIg1BG+f+MswPbh3aqjosQu
MD5:	94640C9F78F7B3BE2C3A99CF12F75561
SHA1:	B2748D6E6CEBCA31C98F91F37A0825F8F3B87194
SHA-256:	678EA7AB44FCA856C110E5D54E482F1217236CD2C4028BA634E5AFF9B6947D8B
SHA-512:	018DA5F656A669CE7991BEC48F23EB50C99BD28829298E1923CA24177AB57D458DFCD882276F8C8D177F441FFADDEDB88DDDAF5C2199B4AED6D8B56930BD026A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f2d3f239cb8f4a1aa1312b2470f03bda.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76491LHUK1v

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.42717413165688
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm64qR7sgQzRqjsjOdy:SbFuFyLVIg1BG+f+M63R7sj4jNE
MD5:	4EF14234612EC89EBCC570DCE1269456
SHA1:	93585B96051E7ACCCBAB67927E0698576C36C974
SHA-256:	F80191EEAEEEC5E8C3570E5E8266FEA07397F996B25318E29F269B2114965D4C
SHA-512:	47661F248241B686167A2B168E7333CA7E1DEEC419EEB110AC6AE416F1F30ACD23383372EBCA68A20946C5B7016BC2C986EA9EBF5EF585724C6DC7E0C2AEF273
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=06443ae7b0b845a8b011930634c8861f.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:764929SfBbt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3974224626846965
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5fjWsXXRcAos2lsj0:SbFuFyLVIg1BG+f+MlWsXHjbVC
MD5:	DC0C988077C1B6E9DC34CFE7D7B01D8D
SHA1:	80C2651505FFFA2B3C94A512D1D4B69862AA504A
SHA-256:	70CF9564A4F4109F1F06BC0F69DA73320C34A6C624C07657D03DC05FB19C71D9
SHA-512:	AC964CFFAAE67DB5693E52EA1AE5EB48BEC1CDC8B5F0EF4BD367DA8F5F368234FF719D30873EEF432B4185AFB4535C140224A0727610C7C24087453006C690AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3d1b39ba34c24087b7df8de4b07249e3.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76493rFpwts

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.43278824117375
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm58T0NRmA7WSKS3+sjsx:SbFuFyLVIg1BAf+ME0DHTjNALyAZD
MD5:	A450A030FB6F6FBF68F8A7B2FA31A60A
SHA1:	040576F7F28FD99FF1AD6F560AE035462BCD8D0D
SHA-256:	D6854999F7108D01404A2F9AA70B732997A439E32DB176556931E9E6DE24398B
SHA-512:	CFCD4D2ED85CA3D971BE3A0EC838132717C7D75C9194DDF402D3BBA05CD59CC35D983DCCE4178C54EB3785772EB8DAAFC5F3238812BAEDEB7F6CDA45EFD36737
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=361467b0d8a34dd3bbe2e44025376c7c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:764945wufGt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.36580047491039
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9ZSRA6EfXSCKQBUUL:SbFuFyLVIg1BG+f+M3SRlepBUTqjoa
MD5:	60291E2AE1307E7A57C77A3A6172EDD9
SHA1:	90A69B54C6E22960B3B7CEFC3D5BB159023E320E
SHA-256:	01948B0FA926ED51DDA6F7F5E6CBE70D6ACA4CF60B2A5696B8F54BF5BE63C512
SHA-512:	3C8467A786AF955845F023471CFD09472B01DD22F5D968EDD926D8726594617DFEEAB0404C9C104A2D1DE7F5C5428F1D40C76E060E5F4606307733C20E937A7E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7c859a758a4e49a88278076c5d1be0d1.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:765292bIGIv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.467075506139748
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm58VK2/XPR3RvsZjs2BI:SbFuFyLVIg1BAf+M2K2h3J8jNdQIeXD
MD5:	C5450C94F78120EF8D15FF06820FAE78
SHA1:	030796FB00FCA001F86EE7A57FBD9F4ACEE95C57
SHA-256:	0AF7CE0B8BBADE6093D99B525815EF4B0D9D6B0B6B74999399A88D62B3DCC582
SHA-512:	B0AF879B0879FBA4C3EE6871511FEFD180B781038D1497991F85C7B60196CD1E6343962E0EB4F86A46F0C4D3724464557B741E35CEFA74DE035945E53CCED2A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=33b5a745930a4be69a772edc4c9f2e74.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77064ECSHDu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.444812620844458
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MugpOySv+RjZcHcljX+:qgFq6g10+f+M/9SGLmAu
MD5:	3B25B35565F04C674B8DB337FC7A1979
SHA1:	6A5CE39C2ACB28C8499EF2643C69C0B9C3C18B2F
SHA-256:	9E7AF591EA8734CED3CBAE16F4FDDB1A506BA65696D96DFDDCA01C9DDBF2EAF0
SHA-512:	99670400AA5BB49A2C5343BDD82CFE040CD7792738A8A2E56D659C46035A78C32D1E7AA49D85A579BCE7B76874B1BC025388542D58730261D5D5DFB03C7811B5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4e23d6e72ee4177b18c8b7c0d9ad6e8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77068dzsR3v

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.322765343637464
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9zIH7TdIB3aF2jshQ:SbFuFyLVIg1BG+f+MhIHX2jtWL0
MD5:	B1C36C74A3963E9C4407EF7A1D64B267
SHA1:	BB9A4BEED3409106BD984D053DE2132BE1F9479D
SHA-256:	31666D7D3BFD176BA4D35C3F79BC0A8AB5B2A10387F13CF0383B334F274B29D6
SHA-512:	A96F4CCB84FBC2835BA4B0998ABEFC179BDF0138D923B3ED599973218BCA2796C6015AB3DF2C18F34D8CB928CAB73DEA98EF9A6CEA07E1BF5CD0974A50B47DFD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72d0d67bf6f84623badd672038ee744e.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:78897aYBHv8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.410277454256307
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MQSGjFP8jZcHcljX+:qgFq6g10+f+MQSQFPqmAu
MD5:	B379CCECDAD91AAD6FE52FF8571F9994
SHA1:	5508D0F43E22E0A1CBC6BE438743505821EF7AF8
SHA-256:	C31C5B01AF5F5B525FD9D1D95B6DD94D773F231FB62779DA201568ED7A04A8ED
SHA-512:	4D01CF15026BF87B19B99EBD89BB663CCBCF6876A1C4C1DF7EF63DA39ACB07CCE49C7635EAA4A86B7F18C51522F4A8F9F202F4B3E8C47CE56D89DB615CDC80EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=10848e423eaa4e228e20bebe6289c280.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78898Zu8rh7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.435239191452689
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8DSFdE3XQeH8josQu:qgFq6g10+f+M8OFdEnQCaQu
MD5:	82BC5675D129C2BA75BEBB4AFE133DED
SHA1:	F4AE09BB6A2D924A3830874F4523C849AA1F8622
SHA-256:	53DF9D5463871150EE104ED9A5DA093DD997898C7D379BA6A633C950936A015D
SHA-512:	BDB3BAE9A4A42008908FA75496E1B2FDF7AB37FB2EC3A857F9BB39F3BE9B48DBA34B763F6A976273F9776608A7989E8B1CCC3E53B55BEBEB01E57F305278B7EA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6f71964a85aa4d35b61d29c5bb7dd118.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78905nhSrT8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.353741397112096
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzijBLsX4kxsjskGp/:SbFuFyLVIg1BG+f+MOB2dqjfGt
MD5:	4AF1C959542DB1C03FF0E31E80F32BB7
SHA1:	FBB717CDB221A08956E0F4AAA52ACC4B5B2AD2C7
SHA-256:	D6498DBD6CB3837E061513968695CB699DDE3563F77BF6A45A9D68BCB097FBF5
SHA-512:	80D1F90C6B238260F00BF5EFA9AB4573EDFBB36B94F4E1A68A50C07464E5CBB52C612B78596F38FF4ED5F14911F0EEF309E4336676973539C82DF9D176CF05A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d9ce1304df24804a3ed2ec37ce322f1.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:78906oB8BJ8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.355694219091419
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz1HH+X/0UBWs22jsO:SbFuFyLVIg1BG+f+MdIv8s22jtWL0
MD5:	8336F2FD509E81B404DE5A5F941AD7C0
SHA1:	CB9FB2EB6F5776243D13F0914E783705B2C3339E
SHA-256:	D697D670E001C3D99183F7B8E917C24A4C5B7E2DE7D1BF7209EACDA64459C741
SHA-512:	9E099F50344149E543DD74EDC8E6D1F9D158D22D77B0FE943892642EDD0FA745028352F708B879E9EC45751260B60857DA8B9354D952EA7F81BF67F4C3672F7B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97433e0d679342898b3a809e1596f687.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:78986lksrY8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.429637413951507
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+jDh+qGdQATEYgrx5:SbFuFyLVIg1BG+f+M+oqGdXlgrqjNE
MD5:	213C5C762C0493DFF26150E8D312EBA6
SHA1:	8664FA18300955DF51350666391782607CA1C673
SHA-256:	6B18CEF6C7F1596D2723730469A311DECB634FF6813C8F5D6DBEC6676428755A
SHA-512:	675136629C752AF06B0F395B9EEB66499454787C92A1D7AB175ED7A96FAE7144C9DA3A80332CE2F316584858E5CEA02D8CD7B4321A39EEA7C34A5426627813C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4440cb6f8a264b0194e5c85c2f2dec4a.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:789874TxpM7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.403370174630422
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoniK3HGAu+sjshKJg:SbFuFyLVIg1BG+f+MonimujbVC
MD5:	3B9E8579D3235CDFEB5CAE6563BC77D7
SHA1:	5142CA948EA22BE12B08B7C0996EC7324A48B219
SHA-256:	884431AA2EDFF86E5FC2E8CEF473B8598C3140F105EAD4EE834D87D469D4C0C6
SHA-512:	79C35F49ECBD4BD24D7EA5D88F570DAD3EDCE42217ACB0CB40D18F6C28E379BF18259F21212B1ECA0F48E823A01E13CB43374E3BB725934823CF0BC9FF7B8D10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5adeca9debf4b339b7617a57c3d221a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:789887zVxz8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.425309477092183
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/LXTSeZc0DdkYl+sjsx:SbFuFyLVIg1BAf+Mn6Y1jNALyAZD
MD5:	92BB59FF972CA02C68115D0E690055D7
SHA1:	5A334E94B592BC8385C463627496E22FCA27B99C
SHA-256:	FA013489ABA35CD23D87DBB8F63B2B4EC429E81655A733C0C94DD80895B32521
SHA-512:	5DF9DB95C449FA257491387C14BD74C3AFB163459E0E2692CE89274725DDE2BE521E2F924BF383C42A09D8BE6E2B082270561F6214617A7989C88B9C35F23241
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=58578267b01a410e99a8f8b18ba0af3a.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78990azqNZ6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3703229774091925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+9n3ESZS0grqjs1Ha:SbFuFyLVIg1BG+f+M+6S80Tjoa
MD5:	30C1CB1D71E0B4112A74D4C29D92815D
SHA1:	1476C7823A320EB6D446D2BF75F5330560467FF5
SHA-256:	74B75FAC94605FA76524C3364422F023D2B57FCA6F4E34723C1985C02D2548F4
SHA-512:	4BADC2FE54A8CEDB843E2600E5582BBE557A362E8B00A13057A99640EBF35C9C4817D72707BD030551A0077D14D525C7148ACE8AB47EF647AED9825D0CB1EDD1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41ace693e1e54a29b0a9fdd8823b3816.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:78998ubyR2a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.47046786388788
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuMzAlBuv8jNdQIeXD:qgFq6g1af+Mevu22D
MD5:	52D0B3BC3848CFB64BED53B2352CFAB7
SHA1:	1FF31A68E6EA263AF682709B2A00E1AF8FBC19B9
SHA-256:	0AA795A5B9519F3551C4244EF9977DFABDD99CEF7DB131BFF6341067090C315D
SHA-512:	95AA7C958255E2B5BDC83A284366075E7621F7709197DA4E3F519B44429B261B5617CAE618D28309349EC47146E01D25CDEC1F3E3DAD3D2C7693D04D4A08DD6D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d6e9c31576c946f78378fd1746eeb911.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:797230RE2hZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4767009908567035
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsWVdnRdR22jZcHcljX+:qgFq6g10+f+MsiRdR2YmAu
MD5:	982DF85982367F192F52F311FBE1F9E4
SHA1:	9C827E9216A7292BB93724515E05402339B3BC67
SHA-256:	027D06F79459CF511BF64306A680DF93468AE390A4A3745F6421286E5373FF06
SHA-512:	8BBFA4AE7B774714C62A913CE1BE3A0E0D788F8F903D4D1694A02932E5D51B35693A4E6B947F74F970DAF171161DDD3A5826E64917FCA977791C29D23153AC8F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=58a6830871bb497e8a779144cdbbbcd9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79724kDtRDW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.395913923908523
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpdtSYVGFUQIo22jsf:SbFuFyLVIg1BG+f+MEYsHIoZjfGt
MD5:	277B4139CD1F1F0BA6EF647E623FAD55
SHA1:	E16D17B14C188A2376751D7A33CCE6ED19A23397
SHA-256:	3C64FF7055024D7BADC1134DD2BF3E2C1742221A401588CCDCD0B3DEFD703E8E
SHA-512:	AAB44135B1596B11DEDA3AC2E272862713891F79ECC759657F92A34FF6BE41665AAA8AD43ED9D70B7E05F15800621920ED72F207BCDB733DBBA2A0F194F4A240
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ccfa49cda0324b7fa0cc7cd650d8c518.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:79733Io1IBY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.351801666347487
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm44rXGJBSvl8jshQJT:SbFuFyLVIg1BG+f+M44rrl8jtWL0
MD5:	02242D669307EB238C03A5CFCF609316
SHA1:	3F7880433B5A83012E5EE50EF73B0C6BEF9F074D
SHA-256:	31739DA8FB57FBE0286086579C047DD0C2F58232BAE4157B8C6DC84CB65DB5F5
SHA-512:	050EEB2C30160E0032DFD484555B4D1D4CDFDBF20D22DEAAD10943F37B23528D515F59E90188F6BBDF9DDBCB3FB84FD46EAF3CF69139277613202F7E214F6E01
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22f80db6238b42c8815d5ff0f0b9e2df.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:79734LnlAdZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.411270454648293
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpNV+OxlWEudRTrqjx:SbFuFyLVIg1BG+f+MHV+OxlWJN2josQu
MD5:	CB598B78DDBDDCDA5D5518D87FD2E9A8
SHA1:	F50D11259E30AD731A82983BF868091F533D85EB
SHA-256:	A5E163953C9504BCF358C051526DDE17F17787721CC9831E7C50A49E6A49264B
SHA-512:	3A7A948E129074DC3A89266F56B8BE557B4E4A09EAA5EE41417A30B4D9563B29FA8B3073B5AD3F86BAEAAE91BA42EB544C4AD1E173BD201A6C7B72511C39B57C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4649e69e15e4f7fb0d6fd1a0148934d.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79741QVuUEX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4342834212554445
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8jDXSnWGHZKGfs22O:SbFuFyLVIg1BG+f+M8/HG/E22jNE
MD5:	164AADC59D18CDFA8AB5C5C025C2CD84
SHA1:	2C620E9991271A1184CC0EA2F791C09179EB5C30
SHA-256:	E1BAC825F565AECDA00E82CE78CC29CA0AC6BC5404E65C7B8E7E72DCC110382B
SHA-512:	DCD15CBCAE71D0AB9EA3F4294D2B7DDE2825214388084BEBEFBE1BCCEA3A252B7F17FBBC6A3C06B7ACDE5674D66FDDB1B69FB576E9B41CB49211A618AAA4AE20
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=675f279d73c34a45a3106c467756492e.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:79742TLGPhZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.425069594219235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5sADB2chZTUFRg2j0:SbFuFyLVIg1BG+f+M/DEckFRTjbVC
MD5:	E509D696F5880E0F9725C49980FDA559
SHA1:	F140B191846C70D297B5221EB3262ACF988F3E20
SHA-256:	BBB2095B1863C3E347F25145037EF6A1709C5FCE16C25E6F19D592FE819EF794
SHA-512:	DB859A798440443D8CB9506A301178377EA4E3D1CEDBBF606CBEE821A8D4FEC1CE93C5B7AC7A146DF4F21118609F287207A87673CC5863D1E3A2CA1CEFA12C7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3567a6e8ddb3497789c614bf9a5875ae.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:797431g690W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4606381051354855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/PdTTF0VJqeDvs22jsx:SbFuFyLVIg1BAf+MxeDv8jNALyAZD
MD5:	D49795B68148F9A70C4309B8723F63CC
SHA1:	8DEE12FCD928F1F3D1DDAC430C50CFBB9B089461
SHA-256:	EEC8FE5440D7A5029A696366114DE77EF0F7916E5A5DC2686624E397A6EDA39C
SHA-512:	E14CE781A110BB055B63D4CC10CE4746FE966E4055F55B2651EFBA993D1E4F84308D109DAEBA9A4C4696F0336C05F942C79F7122586D35318DEA29D5ADE87FD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=54d7d9862f554702a5d126ce818db77f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79744635S2X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.426133805376476
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmySSV6Bhwt2uqjs1Ha:SbFuFyLVIg1BG+f+Myh6Gt2Tjoa
MD5:	4D8A3F35862E8622C17922EA541F4F1D
SHA1:	485B908516A125B9B3E6971EF804AC88434CB873
SHA-256:	2373B746BCAEB91178A89DA60A8435B192EE7825BF18F67E6944109130335D04
SHA-512:	1A19955ED2756F4B056B97BD9BDD51338368E4A1C35363F0AE925734D43FC1FE3E8A17696BA67463AD2DEA7C01A1A747EC860158A0E037E942CE6FCA8309E0CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c30b37005244b6c89a1985c82f27f16.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:79872CynliV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.468342835377423
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpNVVTrhTjs2BbQIeXGu:SbFuFyLVIg1BAf+M/TrZjNdQIeXD
MD5:	34C251AB617792AD852904822A5C3007
SHA1:	55828C7BB302E39E32EFCE11350E3D0C8FF0CB1E
SHA-256:	41FA7711DD9C30E40E41B25EA6AB2AF00E5A1B0B1CC1DB3E15A7E077ABDC23A4
SHA-512:	8EA665A7CF82F106F0F42E9D1C5197BA2FD8D9450BCD1B68672E420ECE613AE4073B5A9474FCB5A716C65025C924FB0A9D2CCC68BCE6FBAEADBDE31CA85B6C7B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cceb8f0393c74305901d6af17bbfec54.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80612IYDzFC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.433960628619404
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8lcW4e7edwfAALhxU:SbFuFyLVIg1BG+f+M86/kAghqjosQu
MD5:	D48EBD9F81B125AD4E3670991B677B98
SHA1:	C3E060098B68A2422D609B679274E1F0CB6F3BF5
SHA-256:	0A6F4D16442222A73897E071124C17A6195EBB0F199138BB8075C112A7C49DE7
SHA-512:	C431E1C34719E027E2B7DDDD368F2EE98D8F6A62D44016BCE8C2652B0D1FC955996CB335D133F4830A188592BFC20F33A3185578E696785661FF8BEA8B60E72A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=67393e87de7046498c2b6ffe61c16bac.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:806190jzh7A

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.481979442941841
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MBx7eJRqjZcHcljX+:qgFq6g10+f+MX7eJqmAu
MD5:	D44947273F621E94D9D826242641E5E3
SHA1:	F20B7997A25BD2B9E74DC49F7A15AB85B1D4353B
SHA-256:	BDDB2288B5AC4DD6BFC9EA35F2A6F541DE1EFAA76D46EB823DC137C685FBC36A
SHA-512:	0ADF74001A0249FE6DD45AC78CE06ECC5562814AE24D7C49DFB0FE867537D4277748FDBD63292A66CF27CBDACDE8FEAA31496B1AFB6CFD7A4C22999FECCFE3E9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9926b09a2b44e3cb71795df141d2041.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80620RzcDfA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.371841705893711
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+ATWQEgwVBl9rxsjt:SbFuFyLVIg1BG+f+M+2iP2jtWL0
MD5:	714B767AE7D25DF5D92868FD7A649D52
SHA1:	0B184F0594BE3ADEA7121CC9027AD52B538C3D20
SHA-256:	D9F1B95F19541559D1066719A62798CD3BB6F4E06DFF091FBB4CC084F106B091
SHA-512:	1CD9E5A8E4E4DCCD1761C8FBD2E0AA796AD5135A9AEAD875CEB926EDFC0A77748A8687DD59396CDD8106CB71617544EBA830339E202222DC03CF681962426649
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4355632ea0b74306a99882bdcc1bc102.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:806993wJ9pC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.41570834542545
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8EeldRRYnkPvAuqjW:SbFuFyLVIg1BG+f+M8DXYM8jfGt
MD5:	5664E4F11C1FF3F60615A6B9D2A346E9
SHA1:	0EB87A9C8B108C5320B92717E33E921FD13C18F0
SHA-256:	B977FC893C1391D20D0D43EBA2D1E36BD66656691A27CD66ED5D10E21CF02796
SHA-512:	67C398F7575CFC8119E4E6FD198404FE1A6AA25CF87C06E114C920004DD772ADC072FBC2BBCF846A11A8635C47CD42DE234B545BEF1DE115CAF5FCE18E9FDD25
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6a8e84a658334bdfa2e4c4391a74b59d.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:80700skAyxA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.36160907113039
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8iUBgUhMEvsjsjOdy:SbFuFyLVIg1BG+f+M8zhWjNE
MD5:	B5484890C7093C1DB59157C170D689B1
SHA1:	D09C6FC9713190DD226A83A34224A5E52326AB41
SHA-256:	4CD26BDC4359EC2FDFEE727A29CB7F7C8DEA50BC55805CDC321932FDBD8390F2
SHA-512:	C07317735F0506E6716628087BEEC9426C34C8C8382E31F559D350C596A978AE6D50484FC94644C94E7F396D30274427934CD6815C2479BD476D907E146037D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60434d33430e40099e76e17bda3dfc0a.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:807013kXYBA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.406861820898012
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8dcxRSPDSc5gXqjs1:SbFuFyLVIg1BG+f+M8eXS7xg6jbVC
MD5:	B9778A63F9A21009C821E2C7B8744C36
SHA1:	31629799D949917ADC2D35396C29DB2127C63D17
SHA-256:	C49DDABA0C9A68D2C3F389E2562268A72FCD6A5670DB46E3ADA5F8708367236D
SHA-512:	5A4B716A15F2235B8A276985C8056122B75B7D8EA4FF410858D350053F38C5C00BBFA6C7F24886DDF0D90A02C1E698962149F3555CDC96020FC0E65062C670D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=63ec4d2e299e4159ab3e82cbf79e9944.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80703PpTo8z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.432066676564056
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrzP3jdJHEgGfSJ8js2o:SbFuFyLVIg1BAf+MXjjHPZJ8jNALyAZD
MD5:	CCEF51082058F78411E705FAD174A1A0
SHA1:	98BE7E8651BBEA7E21263A62A98A66E56448DDB9
SHA-256:	799F5956901302971EEB4301BF388ADBD52DC3AA393E55ADD9FBEBDF0D6202B8
SHA-512:	0B22474972805E3299E54B478C3180E2F024F34497B6D053512470E6405941D5797C4E7463435F08C254A87E2154A5DADB7422D56A49BA3E9E292C21A2AADF16
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ab6f522681e340758f0baf2a0cff7318.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80704YcklaB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.339770397986878
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpuA1UWaDhA02rxsjx:SbFuFyLVIg1BG+f+M8kU393Zjoa
MD5:	26721E040DBCB427021C613247AED8A3
SHA1:	CC3F2DA9DE50F9DC68A2AEB8C9AF20F1C6DB3F41
SHA-256:	BF92653452A2CC5FD0E1141F773605018578156E909B210DB9833606257255BA
SHA-512:	85FEE884EA88C98886456B2FCB5D6CA63BE9E46409CB393E547485E2D683E6BD79FA0B75892A9CC90206943C5C152F0F4BB4D84A99ED8CE05E39E49279FD6242
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cab47e896d4648ada13be4f3a761e33b.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:80712m7OCyD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.450563925782574
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzveCuGR8ck2lsjs2BbM:SbFuFyLVIg1BAf+Myt22jNdQIeXD
MD5:	9DCB874C2CAF3388CCE36B4AAF79A8F9
SHA1:	DB7739720826AA1E246238461C33F5BE849C9663
SHA-256:	0F4E99D36A22F8A99B8A375F87D78D1F27F7C4F6EC378B495BA11254B70B1C0B
SHA-512:	166D7D1E6B98BD905D7DE60F8FDAB83A472F9BA3FF1CBF299B3CA8F9314D41658950F7C407F943E857E2F928E43387B8F3CCB5183D5CE0B2F30A0EB747DAFFC1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90f2c2c889c24585950ac4db1e5a8d42.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/seats/.#seat00PSGFs

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat018Lojj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0CuLPeN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0J5hvIv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0anFJEb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0b6owog

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0e9I3y5

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rMaHlC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wnP97X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0zK0ZCT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mWdv:mWt
MD5:	DE4E39B460DA9D2AC1C62540388ABE2A
SHA1:	9A1D1BA5E7D83B3F25D89256C7A20E4390F88D42
SHA-256:	A282781FB71E4D0B3797115D798BEA13AA10B1D0C0301E53E4A7F59EE13E5D91
SHA-512:	3D6CDB612A378D2F50C74D540DA3F175E147302C99B73A814C878F9F6314F3AF93BF18F4FC3031168056E44F2FB7E24727259C9B99F74DE0C160E647F5A58A64
Malicious:	false
Preview:	7038.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:0CsXlXEWtl/YJyg/t:0f+ylA8g/
MD5:	EFC08E9CCA50A6223B532CE89E124347
SHA1:	2D772B65622D43A3F8B5BA3308E87313D0728235
SHA-256:	3354AE9A40709D4C2B8A73203007A952101EF099F705299AE4472B30D190F05E
SHA-512:	2DD776605F34FE612CF970EDCF095843CE18124BC514E238C75402BA6F8FE2D765D2FF458133E402DB0BA623DA44EA2B5E874E13D2D4D08D385773F676F243E6
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................;vg........................................

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.799071076066494
Encrypted:	false
SSDEEP:	12:OrTFaZPaV5pGiDrTFUkiDrTF8SrTF9MuDrTFvAvmlrTFvA2+VIrTFy:i8ZedPOZPGuHVNAvGNA2+VEQ
MD5:	25A7A1D1C6131AEB36254ADC17534BF3
SHA1:	EFB9E1E01B39207E3F8A86958328C5F10874A77D
SHA-256:	F98C22B587266B33A356C5BFA248EB0FD782BE62A427C924E69B1F79F1898002
SHA-512:	DAA1039E3DC1CACC5B134B3B825FAC7E1CF03B6B96B5EC207E767D31C6EF8A3DFF6E73BEE8A1BDC18BEB5F2D095488AE577F9E921062AD19BD906C965A78A53C
Malicious:	false
Preview:	Jan 2 01:12:21 galassia systemd-logind[6981]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 2 01:12:21 galassia systemd-logind[6981]: User enumeration failed: Invalid argument.Jan 2 01:12:21 galassia systemd-logind[6981]: User of session 2 not known..Jan 2 01:12:21 galassia systemd-logind[6981]: Session enumeration failed: No such file or directory.Jan 2 01:12:21 galassia systemd-logind[6981]: Watching system buttons on /dev/input/event0 (Power Button).Jan 2 01:12:21 galassia systemd-logind[6981]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan 2 01:12:21 galassia systemd-logind[6981]: New seat seat0..

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.3755317395372328
Encrypted:	false
SSDEEP:	3:F31Hl9Zh6Gu9/tllZh6Gu9Pt:F3jh6VTh6V
MD5:	982308D5D1E2DAFB4FD5ACA05BEBF410
SHA1:	AC11ED7945A75E648D2C1FF6567589164364311A
SHA-256:	6CCF6076BF9786F7CCA1CF844AF100A77456C8087DBA4F23CCD479A1C8A2503A
SHA-512:	5A8BB03BDC4B2C3CD8E3B4746EBB65E85FC0F8E84B9170ACE9730308DA4DAF8DEDD62287528437D3F8427DC9638731323549707BB389D03DB0793C19E015E62C
Malicious:	false
Preview:	LPKSHHRH.................lX.Db.......X.................................lX.Db.......X........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlRDrB1nDrBll:F35rDr
MD5:	6250B6D08B76424EEB275622D437F866
SHA1:	0454881FE06BF9A1D5F744D8C6FFD4067288E82C
SHA-256:	30002599C6E3EC53E39632AA3489B46440A89A0FCBE282F5E5F0EF922C479615
SHA-512:	7DDC6FCB7A1CF20B1DDBBFCEDE401B21A33993FB43AD254DA9145D41421F5C9E07A07A27453DC366259F3296B3DFB21F9FC5EE2F546F8D5B0868DDABC658181E
Malicious:	false
Preview:	LPKSHHRH.................q..m.HQ.....w...................................q..m.HQ.....w..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	4543
Entropy (8bit):	4.707561257293624
Encrypted:	false
SSDEEP:	96:51Dhq5KKtngZhI8+xfco5dHZ5Tl/Pl/LYxybdrn94fTRFUn3BrBQrDPU:ojyQ516nPU
MD5:	5261D58A5DA38DD80AF483BBCDC87821
SHA1:	C738DDE14A53BBBCE4CBA938B0997375CEF34429
SHA-256:	A48F5094B2C9E331A0FFEC5840616B76A700B0B72F18D2FDE4327A7828E1E960
SHA-512:	0999C0EA1A651E6833ACBE1C9AD5A47B455CFE15487536817E0832737C2C8A6CE4A5B4706EE338C10249CF95FA6EA461ABC815A742B6B5861F72761D01F344B0
Malicious:	false
Preview:	Jan 2 01:12:13 galassia kernel: [ 293.083547] blocking signal 19: 5571 -> 3157.Jan 2 01:12:13 galassia kernel: [ 293.113401] blocking signal 9: 5571 -> 661.Jan 2 01:12:13 galassia kernel: [ 293.119693] blocking signal 9: 5571 -> 725.Jan 2 01:12:13 galassia kernel: [ 293.126054] blocking signal 9: 5571 -> 767.Jan 2 01:12:13 galassia kernel: [ 293.132329] blocking signal 9: 5571 -> 769.Jan 2 01:12:13 galassia kernel: [ 293.138620] blocking signal 9: 5571 -> 780.Jan 2 01:12:13 galassia kernel: [ 293.145012] blocking signal 9: 5571 -> 940.Jan 2 01:12:13 galassia kernel: [ 293.151870] blocking signal 9: 5571 -> 2955.Jan 2 01:12:13 galassia kernel: [ 293.158227] blocking signal 9: 5571 -> 2956.Jan 2 01:12:13 galassia kernel: [ 293.164625] blocking signal 9: 5571 -> 3157.Jan 2 01:12:13 galassia kernel: [ 293.925053] New task spawned: old: (tgid 7037, tid 7037), new (tgid: 7037, tid: 7074).Jan 2 01:12:13 galassia kernel: [ 293.954633] New task spawned: old: (tgid 7036,

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	14269
Entropy (8bit):	5.037710806844087
Encrypted:	false
SSDEEP:	384:AOl/eW6JwWRqqU6nndhZ3/fr7ajtpZ3Oq9ih7EHx7r+H8j9wn7yXcBvQQb0WyN02:Jl+wWgTOqv
MD5:	B1EDE596C0A12458E9445E1C51F29BF5
SHA1:	26D5897C8863E38E6CD020E6306925301C60F06B
SHA-256:	7E4F1F846267EF733142B1104CBE03FDE935FEE0951A0C92B19FEBD057772530
SHA-512:	A39CA738C2FEB273E509AA00673534DF7EE52681752F17980A1B7D9A8E974CA7FEE16717533715823C2EEE2A32C3F1E3CA547D06C1116554DE70DF03ACB7AE1C
Malicious:	false
Preview:	Jan 2 01:12:13 galassia kernel: [ 293.083547] blocking signal 19: 5571 -> 3157.Jan 2 01:12:13 galassia kernel: [ 293.113401] blocking signal 9: 5571 -> 661.Jan 2 01:12:13 galassia kernel: [ 293.119693] blocking signal 9: 5571 -> 725.Jan 2 01:12:13 galassia kernel: [ 293.126054] blocking signal 9: 5571 -> 767.Jan 2 01:12:13 galassia kernel: [ 293.132329] blocking signal 9: 5571 -> 769.Jan 2 01:12:13 galassia kernel: [ 293.138620] blocking signal 9: 5571 -> 780.Jan 2 01:12:13 galassia kernel: [ 293.145012] blocking signal 9: 5571 -> 940.Jan 2 01:12:13 galassia kernel: [ 293.151870] blocking signal 9: 5571 -> 2955.Jan 2 01:12:13 galassia kernel: [ 293.158227] blocking signal 9: 5571 -> 2956.Jan 2 01:12:13 galassia kernel: [ 293.164625] blocking signal 9: 5571 -> 3157.Jan 2 01:12:13 galassia kernel: [ 293.173269] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 11..Jan 2 01:12:13 galassia kernel: [ 293.173345] systemd[1]: Stopped Jo

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:0CsXlXEWtl/YJyg/t:0f+ylA8g/
MD5:	EFC08E9CCA50A6223B532CE89E124347
SHA1:	2D772B65622D43A3F8B5BA3308E87313D0728235
SHA-256:	3354AE9A40709D4C2B8A73203007A952101EF099F705299AE4472B30D190F05E
SHA-512:	2DD776605F34FE612CF970EDCF095843CE18124BC514E238C75402BA6F8FE2D765D2FF458133E402DB0BA623DA44EA2B5E874E13D2D4D08D385773F676F243E6
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................;vg........................................

Source: fqkjei686.elf	Virustotal: Detection: 39%			Perma Link
Source: fqkjei686.elf	ReversingLabs: Detection: 42%

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.869091679964571
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	fqkjei686.elf
File size:	121'516 bytes
MD5:	b1cac6c2a1927bb33619b37f861bb91f
SHA1:	65984d2cf510b56444cf27e45f1e373603158fce
SHA256:	48aeb716656f78e79aac447a57d21e668159c30adc3fefd790744e253459e8b9
SHA512:	c578ff0c523495b3c17edadb51c8f1934da5be9e65c3af54fcfcb3ca03ac3ec123772fdf39c6bb34cb9c2336514950b92ed75775f77244bba70c504e49a2c8df
SSDEEP:	3072:yYesPRfgm74E/hSo+ELPQIFnDI42oDATI:yYesPRfgm746hSo0o8TI
TLSH:	2DC349C0F547C1F9D4930832506AF73F9F31D46551B2DA6EEFAA9E32DA63842820679C
File Content Preview:	.ELF....................h...4...........4. ...(.............................................. ... ...H..............Q.td............................U..S.......S....h....sc..[]...$.............U......=.h...t..1.....!......!......u........t...$............h

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	121116
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x163a1	0x0	0x6	AX	16
.fini	PROGBITS	0x805e451	0x16451	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805e480	0x16480	0x2c53	0x0	0x2	A	32
.ctors	PROGBITS	0x80620d8	0x190d8	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80620e4	0x190e4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8062100	0x19100	0x47dc	0x0	0x3	WA	32
.bss	NOBITS	0x80668e0	0x1d8dc	0x48cc	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1d8dc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x190d3	0x190d3	6.4785	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x190d8	0x80620d8	0x80620d8	0x4804	0x90d4	0.4166	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 2, 2025 08:10:01.354511023 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable
Jan 2, 2025 08:11:21.383105040 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable

Start time (UTC):	07:09:30
Start date (UTC):	02/01/2025
Path:	/tmp/fqkjei686.elf
Arguments:	/tmp/fqkjei686.elf
File size:	121516 bytes
MD5 hash:	b1cac6c2a1927bb33619b37f861bb91f

Start time (UTC):	07:09:31
Start date (UTC):	02/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	07:09:32
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	07:09:38
Start date (UTC):	02/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	07:09:40
Start date (UTC):	02/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	07:09:43
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:44
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfwm4
Arguments:	xfwm4 --display :1.0 --sm-client-id 2f0fb577c-8f27-49ed-9e22-22c0f8688bde
File size:	420424 bytes
MD5 hash:	59defa3c00cc30d85ed77b738d55e9da

Start time (UTC):	07:09:45
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	07:09:46
Start date (UTC):	02/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /home/saturnino/.cache/sessions/Thunar-2692b1019-2e62-4110-a5da-30fefabc5610
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	07:09:48
Start date (UTC):	02/01/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	07:09:51
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:52
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:53
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:54
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fqkjei686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/home/saturnino/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml.new

/run/systemd/inhibit/.#10dOdwp

/run/systemd/inhibit/.#14MLwM2

/run/systemd/inhibit/.#14O93jy

/run/systemd/inhibit/.#19vT1vi

/run/systemd/inhibit/.#1Cbk65d

/run/systemd/inhibit/.#1DzHbwW

/run/systemd/inhibit/.#1EiIlWS

/run/systemd/inhibit/.#1FNLW2e

/run/systemd/inhibit/.#1Ga10RV

/run/systemd/inhibit/.#1LpVZOA

/run/systemd/inhibit/.#1XHG22R

/run/systemd/inhibit/.#1YY3eNN

/run/systemd/inhibit/.#1cSZJew

/run/systemd/inhibit/.#1gj71Wi

/run/systemd/inhibit/.#1jqWeCt

/run/systemd/inhibit/.#1oUoPvM

/run/systemd/inhibit/.#1orxE8i

/run/systemd/inhibit/.#1r4LBXz

/run/systemd/inhibit/.#1xMwX22

/run/systemd/journal/streams/.#9:69362IYf4FL

/run/systemd/journal/streams/.#9:69368kSli0K

/run/systemd/journal/streams/.#9:69369yCe4kM

Linux Analysis Report
fqkjei686.elf

Start time (UTC):	07:10:00
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:55
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:09:56
Start date (UTC):	02/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:09:57
Start date (UTC):	02/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:09:58
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:10:09
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:10:10
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:10:11
Start date (UTC):	02/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:10:12
Start date (UTC):	02/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:10:13
Start date (UTC):	02/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75