Edit tour

Linux Analysis Report
wev86.elf

Overview

General Information

Sample name:	wev86.elf
Analysis ID:	1585001
MD5:	1a3f54c2e7eed74ef02e2c02fa4beb74
SHA1:	577b929b3f1e2ab3fb686c6efd3e105df8a0d5e1
SHA256:	eb00898107efe0003d3d4dc8da1afba64dbdae6d2d3d263c2e7bcad4822e8781
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585001
Start date and time:	2025-01-07 00:27:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wev86.elf
Detection:	MAL
Classification:	mal80.spre.troj.evad.linELF@0/172@301/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: wev86.elf

Runtime Messages

Command:	/tmp/wev86.elf
PID:	5508
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wev86.elf (PID: 5508, Parent: 5431, MD5: 1a3f54c2e7eed74ef02e2c02fa4beb74) Arguments: /tmp/wev86.elf

wev86.elf New Fork (PID: 5509, Parent: 5508)

wev86.elf New Fork (PID: 5510, Parent: 5509)

gnome-session-binary New Fork (PID: 5511, Parent: 1383)

sh (PID: 5511, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5511, Parent: 1383, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 5547, Parent: 1)

dbus-daemon (PID: 5547, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gvfsd-fuse New Fork (PID: 5548, Parent: 3147)

fusermount (PID: 5548, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5550, Parent: 1)

dbus-daemon (PID: 5550, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5551, Parent: 1)

rsyslogd (PID: 5551, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5561, Parent: 1)

systemd-logind (PID: 5561, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5620, Parent: 1)

agetty (PID: 5620, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5621, Parent: 1289)

Default (PID: 5621, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5622, Parent: 1289)

Default (PID: 5622, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5623, Parent: 1289)

Default (PID: 5623, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5624, Parent: 1)

dbus-daemon (PID: 5624, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5625, Parent: 1)

agetty (PID: 5625, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5626, Parent: 1)

rsyslogd (PID: 5626, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5630, Parent: 1)

gpu-manager (PID: 5630, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5631, Parent: 5630)

sh (PID: 5631, Parent: 5630, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5632, Parent: 5631)

grep (PID: 5632, Parent: 5631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5633, Parent: 5630)

sh (PID: 5633, Parent: 5630, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5693, Parent: 5633)

grep (PID: 5693, Parent: 5633, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5636, Parent: 1)

systemd-logind (PID: 5636, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5694, Parent: 1)

journalctl (PID: 5694, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5695, Parent: 1)

systemd-journald (PID: 5695, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5696, Parent: 1)

dbus-daemon (PID: 5696, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5697, Parent: 1)

generate-config (PID: 5697, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5759, Parent: 5697)

pkill (PID: 5759, Parent: 5697, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5700, Parent: 1)

systemd-logind (PID: 5700, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5753, Parent: 1)

systemd-journald (PID: 5753, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5754, Parent: 1)

rsyslogd (PID: 5754, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5765, Parent: 1)

gdm-wait-for-drm (PID: 5765, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5770, Parent: 1)

gdm3 (PID: 5770, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5773, Parent: 5770)

plymouth (PID: 5773, Parent: 5770, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5787, Parent: 5770)

gdm-session-worker (PID: 5787, Parent: 5770, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5791, Parent: 5787)

gdm-wayland-session (PID: 5791, Parent: 5787, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5795, Parent: 5791)

dbus-run-session (PID: 5795, Parent: 5791, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5796, Parent: 5795)

dbus-daemon (PID: 5796, Parent: 5795, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5802, Parent: 5796)

dbus-daemon New Fork (PID: 5803, Parent: 5802)

false (PID: 5803, Parent: 5802, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5805, Parent: 5796)

dbus-daemon New Fork (PID: 5806, Parent: 5805)

false (PID: 5806, Parent: 5805, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5807, Parent: 5796)

dbus-daemon New Fork (PID: 5808, Parent: 5807)

false (PID: 5808, Parent: 5807, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5809, Parent: 5796)

dbus-daemon New Fork (PID: 5810, Parent: 5809)

false (PID: 5810, Parent: 5809, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5811, Parent: 5796)

dbus-daemon New Fork (PID: 5812, Parent: 5811)

false (PID: 5812, Parent: 5811, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5813, Parent: 5796)

dbus-daemon New Fork (PID: 5814, Parent: 5813)

false (PID: 5814, Parent: 5813, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5816, Parent: 5796)

dbus-daemon New Fork (PID: 5817, Parent: 5816)

false (PID: 5817, Parent: 5816, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5799, Parent: 5795)

gnome-session (PID: 5799, Parent: 5795, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5799, Parent: 5795, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5818, Parent: 5799)

session-migration (PID: 5818, Parent: 5799, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5819, Parent: 5799)

sh (PID: 5819, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5819, Parent: 5799, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5825, Parent: 5770)

gdm-session-worker (PID: 5825, Parent: 5770, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5832, Parent: 5825)

gdm-x-session (PID: 5832, Parent: 5825, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5834, Parent: 5832)

Xorg (PID: 5834, Parent: 5832, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5834, Parent: 5832, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5834, Parent: 5832, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5841, Parent: 5834)

sh (PID: 5841, Parent: 5834, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5842, Parent: 5841)

xkbcomp (PID: 5842, Parent: 5841, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6059, Parent: 5834)

sh (PID: 6059, Parent: 5834, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6063, Parent: 6059)

xkbcomp (PID: 6063, Parent: 6059, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5847, Parent: 5832)

Default (PID: 5847, Parent: 5832, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5848, Parent: 5832)

dbus-run-session (PID: 5848, Parent: 5832, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5849, Parent: 5848)

dbus-daemon (PID: 5849, Parent: 5848, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5860, Parent: 5849)

dbus-daemon New Fork (PID: 5861, Parent: 5860)

at-spi-bus-launcher (PID: 5861, Parent: 5860, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5866, Parent: 5861)

dbus-daemon (PID: 5866, Parent: 5861, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6223, Parent: 5866)

dbus-daemon New Fork (PID: 6224, Parent: 6223)

at-spi2-registryd (PID: 6224, Parent: 6223, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5889, Parent: 5849)

dbus-daemon New Fork (PID: 5890, Parent: 5889)

false (PID: 5890, Parent: 5889, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5892, Parent: 5849)

dbus-daemon New Fork (PID: 5893, Parent: 5892)

false (PID: 5893, Parent: 5892, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5894, Parent: 5849)

dbus-daemon New Fork (PID: 5895, Parent: 5894)

false (PID: 5895, Parent: 5894, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5896, Parent: 5849)

dbus-daemon New Fork (PID: 5897, Parent: 5896)

false (PID: 5897, Parent: 5896, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5898, Parent: 5849)

dbus-daemon New Fork (PID: 5899, Parent: 5898)

false (PID: 5899, Parent: 5898, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5900, Parent: 5849)

dbus-daemon New Fork (PID: 5901, Parent: 5900)

false (PID: 5901, Parent: 5900, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5903, Parent: 5849)

dbus-daemon New Fork (PID: 5904, Parent: 5903)

false (PID: 5904, Parent: 5903, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6064, Parent: 5849)

dbus-daemon New Fork (PID: 6065, Parent: 6064)

ibus-portal (PID: 6065, Parent: 6064, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6238, Parent: 5849)

dbus-daemon New Fork (PID: 6239, Parent: 6238)

gjs (PID: 6239, Parent: 6238, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6423, Parent: 5849)

dbus-daemon New Fork (PID: 6425, Parent: 6423)

false (PID: 6425, Parent: 6423, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5850, Parent: 5848)

gnome-session (PID: 5850, Parent: 5848, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5850, Parent: 5848, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5851, Parent: 5850)

gnome-session-check-accelerated (PID: 5851, Parent: 5850, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5867, Parent: 5851)

gnome-session-check-accelerated-gl-helper (PID: 5867, Parent: 5851, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5876, Parent: 5851)

gnome-session-check-accelerated-gles-helper (PID: 5876, Parent: 5851, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5905, Parent: 5850)

session-migration (PID: 5905, Parent: 5850, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5906, Parent: 5850)

sh (PID: 5906, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5906, Parent: 5850, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6001, Parent: 5906)

ibus-daemon (PID: 6001, Parent: 5906, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6058, Parent: 6001)

ibus-memconf (PID: 6058, Parent: 6001, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6060, Parent: 6001)

ibus-daemon New Fork (PID: 6061, Parent: 6060)

ibus-x11 (PID: 6061, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6267, Parent: 6001)

ibus-engine-simple (PID: 6267, Parent: 6001, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6254, Parent: 5850)

sh (PID: 6254, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6254, Parent: 5850, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6255, Parent: 5850)

sh (PID: 6255, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6255, Parent: 5850, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6257, Parent: 5850)

sh (PID: 6257, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6257, Parent: 5850, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6258, Parent: 5850)

sh (PID: 6258, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6258, Parent: 5850, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6259, Parent: 5850)

sh (PID: 6259, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6259, Parent: 5850, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6431, Parent: 6259)

gsd-print-notifications New Fork (PID: 6432, Parent: 6431)

gsd-printer (PID: 6432, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6261, Parent: 5850)

sh (PID: 6261, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6261, Parent: 5850, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6262, Parent: 5850)

sh (PID: 6262, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6262, Parent: 5850, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6265, Parent: 5850)

sh (PID: 6265, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6265, Parent: 5850, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6266, Parent: 5850)

sh (PID: 6266, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6266, Parent: 5850, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6269, Parent: 5850)

sh (PID: 6269, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6269, Parent: 5850, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6270, Parent: 5850)

sh (PID: 6270, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6270, Parent: 5850, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6273, Parent: 5850)

sh (PID: 6273, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6273, Parent: 5850, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6276, Parent: 5850)

sh (PID: 6276, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6276, Parent: 5850, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6279, Parent: 5850)

sh (PID: 6279, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6279, Parent: 5850, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6604, Parent: 5850)

sh (PID: 6604, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6604, Parent: 5850, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6606, Parent: 5850)

sh (PID: 6606, Parent: 5850, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6606, Parent: 5850, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5826, Parent: 5770)

Default (PID: 5826, Parent: 5770, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5827, Parent: 5770)

Default (PID: 5827, Parent: 5770, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5774, Parent: 1)

accounts-daemon (PID: 5774, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5778, Parent: 5774)

language-validate (PID: 5778, Parent: 5774, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5779, Parent: 5778)

language-options (PID: 5779, Parent: 5778, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5780, Parent: 5779)

sh (PID: 5780, Parent: 5779, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5781, Parent: 5780)

locale (PID: 5781, Parent: 5780, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5782, Parent: 5780)

grep (PID: 5782, Parent: 5780, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5783, Parent: 1)

polkitd (PID: 5783, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5793, Parent: 1299)

dbus-daemon (PID: 5793, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5926, Parent: 1)

systemd-localed (PID: 5926, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6072, Parent: 1)

upowerd (PID: 6072, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6110, Parent: 1299)

pulseaudio (PID: 6110, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6115, Parent: 1)

geoclue (PID: 6115, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6220, Parent: 1)

rtkit-daemon (PID: 6220, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6232, Parent: 1)

wpa_supplicant (PID: 6232, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6234, Parent: 1)

avahi-daemon (PID: 6234, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6236, Parent: 6234)

systemd New Fork (PID: 6235, Parent: 1)

packagekitd (PID: 6235, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6268, Parent: 6235)

dpkg (PID: 6268, Parent: 6235, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6294, Parent: 1)

systemd-hostnamed (PID: 6294, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6459, Parent: 1)

fprintd (PID: 6459, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 6578, Parent: 1)

colord (PID: 6578, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6608, Parent: 6578)

colord-sane (PID: 6608, Parent: 6578, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6610, Parent: 1)

ModemManager (PID: 6610, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6657, Parent: 2955)

dbus-daemon (PID: 6657, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6658, Parent: 2955)

pulseaudio (PID: 6658, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wev86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
wev86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8e2f:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
wev86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6952:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
wev86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
wev86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc08e:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
wev86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa68a:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
wev86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6922:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8e2f:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6952:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc08e:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa68a:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5508.1.0000000008048000.000000000805c000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6922:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 2 entries

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff/fd/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: fingwi.cardiacpure.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.14:34674 -> 178.215.238.112:33966
Source: global traffic	TCP traffic: 192.168.2.14:57248 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5551)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5626)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5754)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5753)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5770)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5796)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5799)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5866)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5850)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6001)	Socket: unknown address family

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru. [malformed]

Source: syslog.67.dr, Xorg.0.log.140.dr	String found in binary or memory: http://wiki.x.org
Source: syslog.67.dr, Xorg.0.log.140.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.67.dr, syslog.41.dr, syslog.24.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1382, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5547, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5620, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5349, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5517, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5531, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5626, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5630, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5636, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5695, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 5860, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5866)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1382, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1589, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5547, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5620, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5349, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5517, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5531, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5626, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5630, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5636, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 5510)	SIGKILL sent: pid: 5695, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 5860, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5866)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior

Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5508.1.0000000008048000.000000000805c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal80.spre.troj.evad.linELF@0/172@301/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5547)	File: /proc/5547/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5548)	File: /proc/5548/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5550)	File: /proc/5550/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5624)	File: /proc/5624/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5696)	File: /proc/5696/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5796)	File: /proc/5796/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5849)	File: /proc/5849/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5866)	File: /proc/5866/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6239)	File: /proc/6239/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5906)	File: /proc/5906/mounts
Source: /usr/bin/dbus-daemon (PID: 5793)	File: /proc/5793/mounts
Source: /usr/bin/dbus-daemon (PID: 6657)	File: /proc/6657/mounts

Source: /lib/systemd/systemd-logind (PID: 5561)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5561)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5561)	File: /run/systemd/seats/.#seat0ibWWeG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat0XJS68d	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127YGMf8d	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#1278smwtd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat02DZezd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127LOhF3b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c1UTJOBc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127jdmOse	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat08cwoFd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127ksCSLe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c1rd5gVa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c1GSZb6a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127YWi4df	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c1sn7Bnb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c12G9Gqc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c1Vqgqic	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127pYLPkc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat0B8LuOb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#12750SSic	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat05UTqYe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127iPauDd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat0QsnCff	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127FeHiGa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2CIpf3a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127YdbFve	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/seats/.#seat0gcN9Td	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2gFKrFc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2a6THGe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/users/.#127oPSXeb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c25Uzi2c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2IrPeyb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2lK4eFe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2Q6H0Xa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/sessions/.#c2waJcWc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/inhibit/.#1uCSipd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/inhibit/.#2MiZ0bf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/inhibit/.#3dVx9Oa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/inhibit/.#41O16Ba	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5700)	File: /run/systemd/inhibit/.#5DiIg5d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68789T5Fvyf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68796TUMUIe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68797yDvtqb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68809ZO6gff	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68810Nm7Dze	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:68970GEEqHd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69066p6vRvb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69105mX4VPd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:691324QhvYb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69134cUE2Cd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69179dsFwxe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69181LKoAVc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69219VBUPRb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69284S5bh8c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69378zPhfWb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69380SCqUHb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:694522398mf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69454Y33Jfc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69515WxLvne	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69517BkTPIf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70756GDMtJb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70951zgkdzf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70953wVDB8d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:69970wwvzNe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70110UH4E8a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70111Wss3nb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70225ZDIKUc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:70227ZtARcd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71438O4TEfe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71457yoFNSc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71472CWncKb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71561qwVd8d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71562xmoYCb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71585sttTAd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71587mTBCNb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71609XwIQJb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71611tnwp3e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71634oATT6a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71636U9m4ke	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71670IUfLme	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71672HJQUVc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71694W0GbEc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71696gQ9h5b	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71718Hv0Hoc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71720FMYiye	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71735kD667a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71736qetaOb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71758xwTpKf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71760t3XCjb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71778MCi0Pe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71779KrkMOb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71781abKAJf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71782vnGCeb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71789jq40Hf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71790GgvtFc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71814PaBLte	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71815wEPV1d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:718375I3qjc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File: /run/systemd/journal/streams/.#9:71843CK4ddb	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5819)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5819)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5851)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5851)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5851)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5867)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5876)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5876)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5876)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5906)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6061)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6061)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6255)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6255)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6257)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6257)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6258)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6258)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6261)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6261)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6279)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6279)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5774)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5774)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6072)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6072)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6235)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6294)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6578)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6610)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6610)	Directory: <invalid fd (11)>/..

Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/status
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/status
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6110/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6266/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6266/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5850/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5850/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6258/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6258/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6279/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6279/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6257/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6257/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/1/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/1/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/status
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/cmdline
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/status
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/5906/cgroup
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6658/status
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6658/stat
Source: /usr/lib/policykit-1/polkitd (PID: 5783)	File opened: /proc/6658/cgroup
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6232/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6234/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5783/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/6235/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/5819/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	File opened: /proc/1299/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5631)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5841)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6059)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5780)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5693)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5782)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5759)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5753)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 5620)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 5625)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5770)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5770)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5774)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5774)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5551)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5551)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5626)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5754)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5754)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5834)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wev86.elf (PID: 5509)

File: /tmp/wev86.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5630)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Truncated file: /var/log/Xorg.pid-5834.log			Jump to behavior

Source: /usr/bin/pkill (PID: 5759)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5851)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5867)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5876)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5906)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6110)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6658)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/wev86.elf (PID: 5510)

Sleeps longer then 60s: 300.0s

Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5620)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5625)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5626)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5753)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5754)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5787)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5799)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5825)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5832)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5834)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5861)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6224)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5850)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5851)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5867)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5876)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5906)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6061)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6255)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6257)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6258)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6262)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6266)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6279)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6110)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6234)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6235)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6294)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6459)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6608)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6658)	Queries kernel information via 'uname':

Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.957] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.694] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.002] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.236] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.039] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.447] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.123] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.891] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.267] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.982] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.677] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.987] (--) vmware(0): vis: 4
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.342] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.891] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.719] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.128] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.782] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.384] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.083] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.220] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.060] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.590] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.160] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.085] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.645] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.589] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.271] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.664] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.177] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.179] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.403] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.627] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.552] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.355] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.001] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.632] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.968] (--) vmware(0): w.red: 8
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.841] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.809] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.408] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.206] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.447] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.372] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.609] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.291] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.030] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.835] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.249] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.764] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.185] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.603] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.734] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.533] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.597] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.304] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.995] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.264] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.522] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.498] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.573] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.579] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.966] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.864] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.381] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.950] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.298] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.812] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.091] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.583] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.613] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.145] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.171] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.026] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.897] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.189] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.551] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.066] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.795] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.860] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.348] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.903] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.782] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.565] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.132] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.019] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.472] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.824] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.401] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.407] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.197] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.182] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.277] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.829] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.096] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.727] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.983] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.975] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.023] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.232] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.478] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.166] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.597] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.906] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.009] (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.571] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.505] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.878] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.042] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.558] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.598] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.759] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.145] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.126] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.981] (--) vmware(0): w.blu: 8
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.807] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.944] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.374] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.045] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.910] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.657] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.255] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.775] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.151] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.301] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.429] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.139] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.870] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.488] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.441] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.349] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.335] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.938] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.103] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.617] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.522] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.876] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.032] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.420] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.474] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.441] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.627] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.770] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.283] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.897] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.033] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.173] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (WW) vmware(0): Disabling 3D support.
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.393] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.159] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.611] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.195] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.083] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.557] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.342] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.422] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.823] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.854] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.511] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.962] (--) vmware(0): bpp: 32
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.335] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.943] (--) vmware(0): mwidt: 1176
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.699] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.650] (==) vmware(0): DPI set to (96, 96)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.201] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.252] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.711] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.688] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.315] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.456] (II) LoadModule: "vmware"
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.242] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.919] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.038] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.466] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.747] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.540] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.494] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.505] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.638] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.390] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.307] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.989] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.013] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.605] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.101] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.355] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.918] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.546] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.133] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.285] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.933] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.607] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.669] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.329] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.053] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Silken mouse enabled
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.858] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): vis: 4
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.209] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.063] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.885] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.226] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.460] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.295] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.378] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.500] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.387] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.539] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.950] (--) vmware(0): mheig: 885
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.165] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.036] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Default visual is TrueColor
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.069] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.527] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.566] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.273] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.203] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): bpp: 32
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.918] (--) vmware(0): depth: 24
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.591] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.258] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.327] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.279] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): vram: 4194304
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.847] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.879] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.368] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.620] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.116] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.089] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.959] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.316] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.453] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.435] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.867] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.951] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.075] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.789] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): pbase: 0xe8000000
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.563] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.191] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.074] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.470] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.931] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.975] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.110] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.577] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.310] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.151] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.429] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.682] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.112] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.361] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.115] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.989] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.754] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.007] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.925] (--) vmware(0): bpp: 32
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.937] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.704] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.975] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.261] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.051] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.801] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.396] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.415] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) LoadModule: "vmware"
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.993] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.289] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.534] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.651] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.485] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.644] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.803] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.025] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.969] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.476] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.139] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.873] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.435] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.528] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.075] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.398] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): w.grn: 8
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.246] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.156] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.733] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.230] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.323] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.361] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.464] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.239] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.639] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.555] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.140.dr	Binary or memory string: [ 140.714] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:29 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.492] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.545] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.925] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.633] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.601] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.769] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.057] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.213] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.413] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.454] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.224] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.423] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.741] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:36 galassia /usr/lib/gdm3/gdm-x-session[5834]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.459] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.517] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 147.667] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): w.red: 8
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 142.956] (--) vmware(0): depth: 24
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: message repeated 2 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.962] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 148.007] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.140.dr	Binary or memory string: [ 144.366] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:31 galassia /usr/lib/gdm3/gdm-x-session[5834]: (--) vmware(0): depth: 24
Source: Xorg.0.log.140.dr	Binary or memory string: [ 143.511] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:32 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.67.dr	Binary or memory string: Jan 6 17:28:33 galassia /usr/lib/gdm3/gdm-x-session[5834]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5774)

Logged in records file read: /var/log/wtmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wev86.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
wev86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe
http://wiki.x.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fingwi.cardiacpure.ru	178.215.238.112	true	false		high
fingwi.cardiacpure.ru. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.67.dr, syslog.41.dr, syslog.24.dr	false	Avira URL Cloud: safe	unknown
http://wiki.x.org	syslog.67.dr, Xorg.0.log.140.dr	false	Avira URL Cloud: safe	unknown
http://www.ubuntu.com/support)	syslog.67.dr, Xorg.0.log.140.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
178.215.238.112	fingwi.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	main_mpsl.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	wind.arm5.elf	Get hash	malicious	Mirai	Browse
	wind.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
178.215.238.112	arm7.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse
	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse
	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fingwi.cardiacpure.ru	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jefne64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	arm7.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	arm.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	jefne64.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	vevhea4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	ngwa5.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
CANONICAL-ASGB	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	res.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5803/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5806/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5808/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5810/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5812/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5814/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5817/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5861/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5890/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5893/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5895/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5897/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5899/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5901/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5904/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6065/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6224/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6239/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6425/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:s:s
MD5:	F6CBD7909F9B9DEB8991CF039F33B224
SHA1:	ED5D5FF3AC6D3037225FBC8602F1D1924CE7D9D5
SHA-256:	16DD940D4A7D0A6CA24367D7F7872CAFBBCFDD7A38C1E4F935E117D80CC6F120
SHA-512:	4567338C1D963039E20F7FEEC834DE0537881FD83780E4C27BAA1D79F0640253A2F9D985CFCDF4976FDC008B38531A04846DACF57123B4D56546FD56E9AAA3F6
Malicious:	false
Preview:	6234.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:HSVv:4
MD5:	4799A4BF3815E64A26BE7AE2BF06FFB0
SHA1:	4B63B394341ED64A9BEB3467B0EFF790DD8429CA
SHA-256:	F1CF197E723B1A305E5EDCCB4F6885A2C181BC9EA4BB4033809C80F87E908F46
SHA-512:	99E0EFB22C512405CA025216B347530E18C37E16819359B4C301430B9365651FBFC42151F0E79451D55B22CB36909AE24BB8E681A5290BD83DF43275ADEC57B9
Malicious:	false
Preview:	5770.

/run/systemd/inhibit/.#1uCSipd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifVjAIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfVjAApLHK7wR9n
MD5:	93E5B69595976D12CA1AE47026A116A3
SHA1:	CBD76301342F39A36DC639AD3B9000247ED37C64
SHA-256:	75225B3462263B195B6B6B37F0574D9FADE1F5C70F98E3B9BFEB5EBFF66E6285
SHA-512:	161E477598599F5D7B3BD91783D4309CC9C547161E854FBC65DE15F11E4FE4D7A5A5113679F71C4FA5CB511D8D827085E2FE6089115A8723E4C415192FF67768
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6072.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2MiZ0bf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.19157450891941
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+MqKLXv0Rsz:qgFqXQXTI1IlNqKjcRsz
MD5:	3C065E5D38BCEDBC3D1B7828E9F3A5EC
SHA1:	14AF6FDD0F3B2DA29C64F37F30AE88E4F7938EAE
SHA-256:	2039EDF854601905D14F4338F534340D9C2ABC850C0A2A669861910778A1FDBF
SHA-512:	F408908FAF681CA8F166CC4C441B118303141385B3185E738E0AC8DDBAF2EE14AF99FEA1806CA390EB72AD3AD7FF659C60F72AB34E107305EB2B79FF78B20515
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6266.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3dVx9Oa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++h3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+MqKLXv0RT
MD5:	12DE7F20F1E9ADB96898C41521BBBA10
SHA1:	945634F714B7D202952F61CB1E7D9FE4DD5DCD0C
SHA-256:	E2CFBCDDB34F4B9ECDD457885B643B3BC46AE9D4980F8433DCD62B9647CAC289
SHA-512:	386849357157759EE768528A0B29BE769645FD2CE50F15087BE29DD4F7C0809D0A689F5C5864717CD31CA21B4C02C0A29537B4D9562928FFF60252EAD4615B3F
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6266.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#41O16Ba

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++ftfiXulpv5RX8/SflY:SbFuFyL8OAAx+ClpLRS
MD5:	609067E06652ACE3C590700AEDE487DB
SHA1:	31C75D94FF3B9A6D330E410BB73759CDC4692D98
SHA-256:	5C9BB656E35FF7322F4DC0CA10110C767F6E3D4D828119D6C56ECD8F0C1287F7
SHA-512:	E8694CCF12E07ABD42F513D8701A340183293A959B1F7EAED507C9F9D4FFC18E93F2A1FCDC0E7AE5CEA5FE2C439B5127D5B8E9EBDD9E989F5EBA44B4753474BD
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6279.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5DiIg5d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.962003487102299
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifl1mDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfTmDjDJcjKR5
MD5:	5E3BD00E48E1F71A38581DF36D836023
SHA1:	81BDD18CB22BE2E1B745D67C4BB2DAFE1AEDEEA0
SHA-256:	58227878F02E59648F90D9AE4D0A2876FEBE0D0BC58370998E75F958B20DF983
SHA-512:	8E724191278155E93AC032D34849D8BF2BE9F3F218F150B44F810800F7C2D98512C82AB685390283E9F158CB5B91DE1B6E031E82E5F4E08ABAEAE28BE73FFA56
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6610.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/journal/streams/.#9:68789T5Fvyf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.468226453975549
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoAGn9EUEmUU2B82l3:SbFuFyLVIg1BG+f+MovXEj9i22ji4s
MD5:	6AE1354416C006422E2DE91E2B0EEE84
SHA1:	19CF00E0BB86270E9BCEDD7AA1CF813FD10C99C1
SHA-256:	8AF176521CED2026DB2B411D17FB035CD89084C78536CC2148C7C65AA2549564
SHA-512:	58874EC72C9DB90522CC5CEAC4409840652B5379FC973F09CB82D8724239F7E352530535365ADEB8E474EE94C729875448EC46F6B0DFDAC567EB82128690A06C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bedbe514025c4c1a92119b24a1c4b00a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68796TUMUIe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.418081611818423
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpBTDcr3pggXsjs1Ha:SbFuFyLVIg1BG+f+MvTmug8josQu
MD5:	8F9AF4846D4A5DEED1FF16FAFBBD5B6F
SHA1:	D55D84AB992302DF92847931A9268C9E3A0700C7
SHA-256:	9FA1DECC09E6EA22BDF3348ADE2C41175768E5309E410C9B8264B313758A1C03
SHA-512:	F6D5855490BD2D0DF310A5A5F5F3F6D311FA4185C8BCACB1CB2706363D4A1B0133E89FBA241B993BFA556C1728E2F8A4AA4086B73EC640F83B6B20A0B83B2239
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cfb0b6fc36d94583b2e19a453ca09f0a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:68797yDvtqb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.412654234637237
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrP6BUWVHDVBTDo4js2o:SbFuFyLVIg1BAf+MsVY4jNALyAZD
MD5:	D288994C2CFC3A3FDD1BF58B1DC21FEF
SHA1:	A88A46F046251C5A38757A200D4773CE1DC5D65A
SHA-256:	A7C82F3984E795DA7B5F913F95AFF1F4B599616EEE33EA6AB3C0A38C4AEF9FA2
SHA-512:	489C744D9336BA3BF936ADA8F2DAA54661B210D9BC7E0EDC83CD808AD215A7AD977A81705D080ECA95977E8183B007CD53DBCF48D1648331F6B949148E540C36
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=af605a0536b7406dbb2606262d6fb14f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68809ZO6gff

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4345062278028715
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5FEZrEf5oqIATjsig:SbFuFyLVIg1BG+f+MMqO78jZcHcljX+
MD5:	B6391AE9B735DE5CE0FCD4116F1F2473
SHA1:	CB612DABDC4F4081809D2FA31B96FAC5978D450A
SHA-256:	40549C8E77A9055644641F4B595E33D05AF6905A915EB8E71252A00600C04833
SHA-512:	99881BB67D6C8BBEE99DA636679867613686F9DE0DEF056FF1BFE23839E3B6EC5F97BA2454142394A046186C34A362ADBAA23F5FB635D01C91DABCCD71B9BC80
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3c7a60bf9dea444593a66e4ed014e8de.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:68810Nm7Dze

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.500829816288671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7LVPSlTSVc0FR0js2BI:SbFuFyLVIg1BAf+MFPQHrjNdQIeXD
MD5:	DFFCDE98D6C4E534E6B595767115761E
SHA1:	61B316EB760DD2DFB860985DCB52FCAD8F15E1FF
SHA-256:	7128508B4740F09271830A3EDEA67A94BA46A274B4A52655DB1A69015A98720D
SHA-512:	0F38192F3F90EA42BD70E139707885FD045CD71357DBDE55E729B0FDAD14B8DACA0BE0934B7C829F5A9A3029D0F73D4F05F74E9B245CBA0F38813C702BCA35EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f22437c71234788a5500767093958b4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68970GEEqHd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.409947374181558
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/GEBig1dwQzUcR7Nrxy:SbFuFyLVIg1BAf+M+oVXWc/rqjNTZD
MD5:	5AE793A88B890B7549A7212AEDA34A63
SHA1:	356ED8F1DED5E49D63201ABCC4A30162F17B488E
SHA-256:	E39540E74A9995F20178E4CC8F14455AEB08EDD3D7F6189F8EBF9EECDBF02A97
SHA-512:	C4B575579F782F4451B703417503B0042556FEF947EA92566AB95BF4CC936789B58732F94B4DE31C0DEEC55E240E975358BC8D51F8A4F4C4A5C1D59649C4565B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c49464fd3bb4c468dc577461c1e4a2a.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69066p6vRvb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.465546917899897
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4mBygHDw8lsjswxJm:SbFuFyLVIg1BG+f+M4mvDwjLTTIWTIL
MD5:	34D4B68EE9353A467EE3FDF3EF043731
SHA1:	EEAAC6A30BB411D8958DF933593E7EE24ADC6741
SHA-256:	1E94E7FAD995112CAD9EA94AACAB0517F7C6E28E5EFCC1FA531696ED5B54690A
SHA-512:	970C9D4439E47036DEB5C001CF217450C4F8853928F8D81E72A0E56976993FFFC54B03CF6CCE83636C350A538C823A17226BE97F23AFBDEB499AA7186A6FF886
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2775354d252b4be4bbe2cfc638984090.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:69105mX4VPd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3869750995135925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmylSH28XmKyRbGFrxN:SbFuFyLVIg1BG+f+MylfGmKfqjbVC
MD5:	ED399957ED0A04C2CD36755CFF56243E
SHA1:	1062266F95F699FDA7B8B056EBFC7631F4920191
SHA-256:	CE7DE11FBC4942BCE4E01BB1176D8C827146A152433C524DBB7E8B8676E2859C
SHA-512:	ED32B640C343C2727B58C788E0C374BAE8DF37D31CD360CB2B1781E06A3B2FB8430CB0D03C5CDF152DD7612043582A9A8A17844D940F272B30D72593C66D3EEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c2e7e1d9cc447909624e6c83284819a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:691324QhvYb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.390464734885773
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm64RUEG/ECvVPHjk:SbFuFyLVK6g7/+BG+f+M64RUEGVvjNq
MD5:	67306667FF650A1AAE0B5E38345F37E2
SHA1:	FAFB331A4C4A260BFCE18E1800776A89F955E8D3
SHA-256:	0914DF40D4F91457E623428EA9245E17ECEAA46D96B75F278C47E3A77A364B80
SHA-512:	57D2B959DB98BC6C133455B9AEC3AC3AEC57E313B171D88D9CF3F51B7734074D94AB89405C03B8A4E066313F42A1B9A0989DD32F5D50CBF3825FEAA85B7ED1C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f78c741ace447b48cb9b879af104f07.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69134cUE2Cd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.439827057477776
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm94SlwY2JIFWvs2F:SbFuFyLVI6g7/+BG+f+MGfIFg2jNq
MD5:	A2F28F7B4A2DCE4EDD3F08592E267DCE
SHA1:	E0637DEAB32ED728FAB8AEFF9381351AC0A044D7
SHA-256:	ACC7A92A218F56D13769438101E1C144C60350DC0B60923018CF88B53A9FF9B1
SHA-512:	463BF3E526A7C3D934E16D612A7116572A2075FF5CC02CD709BE3515980002437E6FBDC593397D5AC2BECA79353D57AE95B510A368D56E01FFBAE9B7EF1BFEB2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=71c574f438da45349d653e7654bca2f3.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69179dsFwxe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.496433415796444
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M/Ff4HT2jFQMzKaBu:qgFqo6g7/+0+f+M2H4Tmh
MD5:	20948AA64088B8D4BCB3D98CF5C70AA6
SHA1:	769E969B2BD36390BE80E93F7AE11037B6BEC019
SHA-256:	85C68A73BB1FD54E93F4AAFA870954788B86144B8830B525246E09CAC714F1E0
SHA-512:	D1C3C6A275DE9847E4E37AE2FE91383A55165D827C0CB100B31D0A7A0E456B5C42061481A1065EB478FD9D709356BD797A0CD513FB5EDA71CD8204909EEA4347
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d78480d7c5f4f409e4baca18d901abd.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:69181LKoAVc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.447083564528838
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MHR4UgiUgR8jFQMzKaBu:qgFqdg7/+0+f+MHR/giD2Tmh
MD5:	1F81FBEC882FFE60B2BCE5E2D566597C
SHA1:	FAC97B4E3193216811DDC2B14522617675251C9B
SHA-256:	7870F961F7492AF3312B7830D88FF772165E1D43CB511ECF50FB4294DC9AB349
SHA-512:	84A7419BD10581123B538BC87705D8E33D69C23068F0A4C36B6229E54DD17598FB8979B563A545A44193A8D14F8744EDA8D3D2DCF2425A55947E9CFC0EF4E408
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4f9a2db1fa94a3ba80be4a139a45e51.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:69219VBUPRb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.381433376721943
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz7cLUR1vjwzATjs16:SbFuFyLVIg1BG+f+M/Syjoa
MD5:	32FD67E28DF490BF19E039751052726F
SHA1:	EB195C88C1EA7CECED42F0B2CF4848C72386E8BD
SHA-256:	A480D56F39973D14B727433C54F228F32E3ABC864473EFE8B11732CAACB3170F
SHA-512:	AD8D26FA4ABCD5E5438416D5EF009B955A62909087BDC6D332DD3D48AA7ABD9C412F8132EE79EA1F48AB8FF4E2E45758869674EFFD8C4C9C0D8CA9358EFFAA12
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=908f293c34714a12a25d0a29c72345cf.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:69284S5bh8c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.384973879806114
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzWqdHndGRtlsjsE:SbFuFyLVK6g7/+BG+f+MyqdYt2jN3r
MD5:	48046E9AC9949F63E724E15FBE78FE7B
SHA1:	E760BF4F34586F7C864FE36E420B964399136309
SHA-256:	57E823926713791457672D5DD96B757BCA61E35E1B3E827E53A8C060016C2C67
SHA-512:	BABA84855DD99BDA03CAB149B10D5A9EBB27E6B60F46088B91D9E0067DDC9A93240F6C144FC4D51E4A3E10B5F5CB17B07EECD37302EF8A0A5C8AF5AEF68589C8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91f81cc0984a4158bbd862f4ddd52f4b.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:69378zPhfWb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.422911577733035
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7WdsIItFsjs+XW7:SbFuFyLVK6g7/+BG+f+MadNDjFmzXvn
MD5:	17138BB77CCF755A82ADB60EC291B979
SHA1:	FE0FF079960D56D4104A516CD7C07B7454A137BE
SHA-256:	18852203CE204C34D8C3A2C66C39E0D06058676789F52F2CA2FD2CF4B82CBC82
SHA-512:	58C4A8FC7ED46519749BB9A63510F98A7D62EBC97FB0E946FCF417585F8D1C69BF1FCE84F656511EE1B0F1E0668B0483213F41CA55114951DBBEDD925DB52FC0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=118abba80ccf49a2b1b89fd3bf118150.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69380SCqUHb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.401039842260236
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MOzvvY5jFmzXvn:qgFqdg7/+0+f+MM3YPQXvn
MD5:	959F07322293156F827AB6E40EA1CC1F
SHA1:	8F6857854A825FE5DC2B01C9BB409583873D4A04
SHA-256:	2B0AE2EABEB89B9449F2B6C0EFD4423ECF4E871FF000C55F60E53050EA0F5DC7
SHA-512:	4C37CE65301DE22C9DD7B7B221ABC2762E5D53BB9CF582D70978B5CDC80F3205B6EF4FD0C2631EF53EAAAAEF3578E09C48B93B824725041244FA1225BD661BCF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3844eaa19d5492083378990aecefc52.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:694522398mf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.437445552622851
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MobXsmDUTJ8jNq:qgFqo6g7/+0+f+MoQmDOAq
MD5:	DCE314B24725360B849ED3BF609A12BE
SHA1:	62B026EBDEAEE4669B5DEEF312CD222E49B37AE8
SHA-256:	49C2053A01D2B2144CCEBD725353FA794DD06B026FEB6B2530BC60C02635C526
SHA-512:	56BDFCB89124334F28BE61EB92BE2539B7E8D2C7D91C92088BD400CEEB24762916D5DEDC2FC5E6CA2C124AF5F193E095B042CBFB6C4C7696C059AABD1E3F5C3E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b1f522d1d3f7481598d141b5916fbeaf.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69454Y33Jfc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.44348369092494
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmyy0UfWil02lsjsz:SbFuFyLVI6g7/+BG+f+MyytfWo022jNq
MD5:	CCD9A79F3B184EDBB743B2C1564AFE8D
SHA1:	11B2558D88A37F4777AC13FEFB320561AFD1EBC6
SHA-256:	CB21B1C930019CCF51FD0085FDACB136C471ADAA3EC4F5DD9B255B2CA4FB3AF8
SHA-512:	13EEB106B43602BC4C3A1739A50CC82ACD8F856482ADBDF93364F533545E1279DDF5EAB7C5AA6380DDA0CAA9ECBF4BCE57AE1DDD8F9007D89D8CACCC62B56CF0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8da45f29f91f4e5a8cca7e356cd1b52c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:69515WxLvne

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.4983661810532505
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MNTJxc+jFQMzKYA9:qgFqo6g7/+0+f+MBJNTmt9
MD5:	90260A96A3E620C8336A6BE944222841
SHA1:	E450EBA7AE31B9F48EE18B99FBB40B088862851C
SHA-256:	AE17F57F420FD74A59148175F61FBF4DE4EBC98FE5AD677362CA833E08A1597A
SHA-512:	5A23C2F99A10261978C55A986156AEBF4A4A2FA226628BFDC6BE933D3B59B1420EC8F9C6A914232B4E77C2CE0D83EDAA8004FFAE0F957D432470024C7E2D8366
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=53d3f6a09c674293818e35f8238daef8.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:69517BkTPIf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.472449727730686
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MBIkCx9XjFQMzKYA9:qgFqdg7/+0+f+MBGxbTmt9
MD5:	60E1F3962391325E2A5D6E28EEE0CE5B
SHA1:	2FB1AD00F99D7D6D63D1496EA917C01CB834F62D
SHA-256:	01C0E71EC0DB93F1A613412274EDF512EF5AFCF1C13D38CB977D62FCB814855D
SHA-512:	892BCE279527CBAD63051B5414739572D0BF9DD6DDEE0BDBD1C22E86DBB43F0FF36AA170DF4FB0BB33C4E40F37ACEDA68979203199E3CD68091433CEED910EE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14d0a219a9b94eb98abcffcdb9e62d50.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:69970wwvzNe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.468059983326032
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/8SzAZ2jsicWmI2d1:SbFuFyLVIg1BG+f+MHA2jZcH5CHq
MD5:	44C39655CF78FD93A8702F55C8558978
SHA1:	12F326EF430A523A6807DA0BCBF98AB438AF57F3
SHA-256:	289169101E35745002E8A8B4FAEE6AED279CC7CFCEE9BCEA239F679DDF968A5A
SHA-512:	E323108BE926DDA84904857730C972E54072514789EC8E99D1001C6229327F9EA0A6DE64FD98876AD9B8690795050AE70650BC48401B1DBB93A9A06006451E84
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=58f9b17f7f034ea89a06aba346326466.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:70110UH4E8a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.390249243622034
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm76tcdwH2BVyxrqjsf:SbFuFyLVIg1BG+f+MetcdybtqjfGt
MD5:	512DC00F94C4E621527C7D02D8D790EE
SHA1:	2A319054006A3BA297D9A505162FBDC44FF8D932
SHA-256:	604A54FC33CD855BC2927101A17934A372B16986701307477B52826D3B9B8381
SHA-512:	179225E6B1386D2B9AA6405516988CF3CE05936079D2C9F98316E30CBAD870BD9CFBF53F1E9899677C9FFEC5A578E015227164E2F51A2CA2DD3F8D062E91EA90
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a2d9c0b108843baac4c7d04d9fc5fce.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:70111Wss3nb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.33181004358252
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9FAfWf8yEs22jshQJ:SbFuFyLVIg1BG+f+M8fWf+F2jtWL0
MD5:	D6C8A1A2A35FCE560015C3AF362D4A6E
SHA1:	DFB2EB631A69D0E4CAC94847A5576607CFADA22B
SHA-256:	BC2A842915491384F05070E23223691BBC5A8DF01978CA35A09FF09D331CA291
SHA-512:	FCDCAFA0CAEE40B1DCBB8A135F6849428876E04B875B623ADB2DE1451A74CADA4ED8B8B4F8A9FC04DE3085CC31C87A31BCCF4996B786DF362B90CD76D180A3E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77983d2697f0488383c76847d94da049.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:70225ZDIKUc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.4128259052890595
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MHHGbfV1L0jNALQru+u:qgFq6g10+f+MHmb6Wr
MD5:	7234B71FCD1694330285B96043B04DB1
SHA1:	186BD203E53F7A68EF422F62FEE9293BBA6A749C
SHA-256:	B8738A7A3EB90AC45A4B4ECDFC7501EA69DFB0FDDA0A3BDE1B93A91729FF0871
SHA-512:	556A92EEB7ACEB5E8B7F03A918B23EF6778408EBD4F3DB7A7C115817A29EC83E9E4CEC621593EE0D784400EEDBA305F252DBD0B59FC449399D9DF73D0CD49DC1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16f9757c575e4fd8940f74ba9aa1a5cd.IDENTIFIER=geoclue.UNIT=geoclue.service.

/run/systemd/journal/streams/.#9:70227ZtARcd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.446736920958651
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6CODI5ncTiMqjsjOA:SbFuFyLVIg1BG+f+M6T0VcT6jNE
MD5:	22E42F1A663C9B06CCBAC788CBED6EC6
SHA1:	B6D1F2D0DD89BEC75FBF6A74AC847D3103097273
SHA-256:	9D9BC66AB37BAF6E81DFECA41DB2ABE7B4B94B99428315EEF936EED7D83FB658
SHA-512:	8C2B9EF0E442875ECDF471EB907A1A1692ACCE5D34BD916FDD90CC5996DB63E651DFA2CEC24F9D27B5E3AAF44A8BCC575F0BDC6FB5D06EE81E0932A061A7254D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f69ab920bd142b5b3f4f726a1fe3964.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:70756GDMtJb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.340729816876816
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsDdShVU3blRRyP6:SbFuFyLVK6g7/+BG+f+MsDQhVU3bsCjV
MD5:	F64EFBE4B36F9347F6ABB6CD250F90C0
SHA1:	D3252CAE16AA891F7A595612CC3DCDCB49792AE2
SHA-256:	81E2588133ADDEA5BEB1A50E37949389C84B1B7B403548FB18DF818E31C7A100
SHA-512:	F3D977710EDA693EA1ADCDD885EA4955B8F684639579C9E6B27E86F09D105D4CD3D3FDBA24BCCD9C5C9B208F2F8DD3E18633D76B270E3510143F0714EC47DF22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff87fade08344842aa71f44d5c8313f0.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:70951zgkdzf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.434814279771053
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmoAKU/o/Rqjs+XW7:SbFuFyLVK6g7/+BG+f+MocjFmzXvn
MD5:	092A7E52642DAB5378A5778C2B1A9F06
SHA1:	D220A6C9654FD6AB9C1BD8AF8C6F021A13DF5C24
SHA-256:	85E5C3740D0F3FB7D39030764F02D98D35592C7E852BACC2464EA223A49FE288
SHA-512:	935376DA21BC60EB9B7CEAA94151F9349F6EDCB608532E3AADB5321F9341200D387BA16BAEAFAB690F26230910875E7B9A15C0CF6351258F3A445BA1AD534EAE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=be533764542e4ce5b84d2bb25721a9a6.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:70953wVDB8d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.434734217616037
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4ZUzRvv8jFmzXvn:qgFqdg7/+0+f+M4ZwsQXvn
MD5:	91C670E5319CBEFC1667ECF6F32CEDF4
SHA1:	AEFBAFD4A7730C16EF587FA4B1FDB75833112F85
SHA-256:	480BF3501B60D1712557FF3A11A39D89BEAB3019954A5956900FCCD4D372E772
SHA-512:	8717DFE603A48505DE6690A5610049A2058095E55259EE70E8E6BB67486BCACEC2CA955E6E169C4E855745E33C80F3AC6577D904EA1A7C3C542EA7039F395C42
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=28b8a0fc657849bb9521dc690a4aa202.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:71438O4TEfe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.413562443169866
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8un6DEvXsjsmVa5+2:SbFuFyLVIg1BG+f+M8uo1jdcjemEg
MD5:	AA5F8E813F5970F9D578A1D49532FE66
SHA1:	68E26A2F892C1E27348964567AC0880F03B60338
SHA-256:	11ABBE9663DBE6A885C48CF13F210F2A157223E4427565CA642D4C2E32E2CBB5
SHA-512:	4521885957253CB17AAE8EB29A36F5859CBF0A16614ED7BAAE9B2FC752A69EC6E19A40D293576F1D5D5B24A249E1AD497A51B152CD2DF7C05FFEF62514B926C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6780e9059c9d43679a72792f1c93143a.IDENTIFIER=wpa_supplicant.UNIT=wpa_supplicant.service.

/run/systemd/journal/streams/.#9:71457yoFNSc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.351994358705365
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4HEcIPQ/GvF2jswIh:SbFuFyLVIg1BG+f+M4HEjvF2jLIiAvAW
MD5:	EFA4FBC73C95443A3B48E10A1AE42E2A
SHA1:	5A699BC4AF9D2164D38ABFC619E9ACFC57968511
SHA-256:	7AF48EE644C925B5F8180F99681CD01C1554B2126CD3D9A7A9AB64AE352E9DEF
SHA-512:	5C639F12473D8023C229C19632C865FE95D9CB08940FB813271E2CDB3BA1758A800B66FC0C85FFA1635C07D536C51172625BA158B1D6ED36541649C1E7F28F17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2bae200e4d514abca1a57bbe4cf34ed9.IDENTIFIER=avahi-daemon.UNIT=avahi-daemon.service.

/run/systemd/journal/streams/.#9:71472CWncKb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.353461293777447
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvWVBeDP+Xx/ViUKAK:SbFuFyLVIg1BG+f+M+Vdh/cR8juTt
MD5:	F9D9C4254F9AD86CABAE503858137B7B
SHA1:	80551EC217922C0FB5303E88C7D561EF064FC422
SHA-256:	BC20E128663EF5A831B7C71DA4C9252C7C24CA3A7C4BD0B611AB6A6AF8F0875A
SHA-512:	EB4351FE2EE1F5D38388F25779F228A296B1AF759AA160C57CBAE9C3126FFF88E924F763424DB00CF2F97AEDA174ED00CBDF4F87DB64F49A438393913841B0BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e5f0da33f7e04689a3002423f30fe61e.IDENTIFIER=packagekitd.UNIT=packagekit.service.

/run/systemd/journal/streams/.#9:71561qwVd8d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.431754341945435
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4w2z+jFmShmWc0vn:qgFqo6g7/+0+f+M4w9kWc0vn
MD5:	732E1C80B0499E837E4554900BE07486
SHA1:	9FCE79DFC711C5E45834E66BC121FA53EFDC911B
SHA-256:	5FB794EF34EA83FB5486A3D277E6A1CCF82A93EFB3824625576DAF78A6FB6D8D
SHA-512:	F413B625AA14C98B4189C9B8D662955A883B9CC2FF0068F48A08774D500791DFDD2E5BF3AB4CADB17B67ED00616244843ED306E2508C524BFCDE4D4C1E69B569
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2432f19f0ab446e39ba137255baa8d70.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:71562xmoYCb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.436452729082089
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MSTfvcZGrTjFmShmWc0vn:qgFqdg7/+0+f+MgfvcZM9kWc0vn
MD5:	E5AA9E82CD000E2F5FD94F4B64B017D8
SHA1:	E076AB4FEB21AA618C9BB8FB3A750338D5540E9D
SHA-256:	0BA2D01D24973DEF3AE89B9D857D05FA520C1537ED67A9C6CD14A80F08A13AB0
SHA-512:	2B3DB35A3F27C06786A31464E0062D84F6D5BE9F9C4DF10FF7EE49BC41753DF529BBF238DB3158ECE9044EB7BD0C4DEC7B41F3A850CA710DDE0C84D5BCA3F35F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e23c963a6a1642d8958382df63d0c5b9.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:71585sttTAd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.391101039408117
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6uGUndJfjFmShmVxfvn:qgFqo6g7/+0+f+Mnd9kVxfvn
MD5:	768B8380792C62865ED2B9EF577A8A90
SHA1:	868C6CF225AA8DBEB8353EF30A6A3FEDD66381BA
SHA-256:	1A60DCECE9D82ED2D2D2A3A4C17234167B89E8EADF4C7DD5AE483CD9D1CAC16E
SHA-512:	5DC7517EE2CF9FAC0EACADF15A3F54F708A326AA04909F3A8FF05A8FE28D08C45DE2ECA3FC98B6CD82B35AF625C9B592D76DB5EC7953C4B019C1350659450AC2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c9167a00bfc41e5baaa09e51ab6f438.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:71587mTBCNb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.405441118159853
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M84cr8dzGS0jFmShmVxfvn:qgFqdg7/+0+f+MKMzk9kVxfvn
MD5:	2A47AB94B2C45A698BD0CCE5A5404061
SHA1:	8AAA5E0C7797CFA39E3D89070C55894AF4680B81
SHA-256:	A5E63C819F2BDED3C5278C055058D130F0CD15620FC061C06C972B8448F538B6
SHA-512:	6F7ACDCC2827AB0D2B68756B74E1A64098EFC5EB05F805AF7ADE4627920FF66A61B59C049A70AF99516697F0611D2149D3A291C6376E265AB18E59ADD6215B06
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3686a582d4a49dbb024f0a8ec348ac7.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:71609XwIQJb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.442724896908707
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M1tS9pEsp0jFmShmDxfvn:qgFqo6g7/+0+f+MLCp+9kDBvn
MD5:	26E5F5DD71FB2B6189EB86FFFCAF7297
SHA1:	D1757C6C36064172EB703ADC8CE1C90F28073108
SHA-256:	C6FEBCD128BC4A369B96980A1228F9E19E5634DB8DDFE2CCDBEDAF217B9077F9
SHA-512:	620C958BD15FF354BF12F0418C019AFEA97435A65510AFA792A96879C8B7DC2D2BCC1BC852E24D4504E392EDFC1056A6F8650CC6F61B15EB2933A6EC6F0F1AA5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75b7d19271c0475ab1ca1c9a53ef5134.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:71611tnwp3e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.431337846041111
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuUz23ZqjFmShmDxfvn:qgFqdg7/+0+f+M3q3Z49kDBvn
MD5:	D819AB2EB34380696811CF3B48D3C29B
SHA1:	725C9D1C27702D01CB97A51D2602A4AE9DC855F8
SHA-256:	0276CDBE21CDD1D23A2774BA46A86CA89499B6835E2BCF497C1CE7691882A9AF
SHA-512:	E3B0D568152E2527C56E7D99F085C11A0DE90090FB7ECADB8F4D3FD5691A96871F41C7CEB91EA98432C4C57EFA28900DCA25192416AEEDCE7AF644976CC986A7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4d9bdfcf65d40a7a0f94298b1649d3e.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:71634oATT6a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.426228475099684
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MkJWXjFmShmxBrvn:qgFqo6g7/+0+f+MeWR9kxBvn
MD5:	135B528997E004817000DE253994D193
SHA1:	03038FF5E1DD4867424B366501C58FCDA3F17073
SHA-256:	5AD9DA57CC193BD691F6E7EA4D74D667E04733F092C4075392D44E018FF0FAED
SHA-512:	D0F869F0FCDA4D7C7E2916D72DA8AEEDCB71059CAABB9CE392A828151E62AD4DF2B3823894789973259DC8621F7074C6FFCD3BD4F14452D0ECA3EB84B2216A92
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=54d3e4b3e4fe4c1bb1530c54785943ab.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:71636U9m4ke

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.396914899294349
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Ma/uGyFCSX08jFmShmxBrvn:qgFqdg7/+0+f+MK6C2029kxBvn
MD5:	1CD19D062722AFD0A49228A0129B14F9
SHA1:	4D278351B61DFD542B6347A3BB1FE2D2D3CE881A
SHA-256:	49875156DCEE2FBB9860E858CF78E9525C4548DB978854EFA9AA77699F7C6FBF
SHA-512:	056F9D4C09F774FD5BE50B582DF677B4D445465CF3C4E909D3324BC406262E85EDD21F1E6D43FBA475E9AC61DA97922960583B878E31C3AE836A673F13966B69
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12300228fa8c41cea93226228eec8dc8.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:71670IUfLme

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.424378471143297
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoUBwjhTjFmShm5PKJ0vn:qgFqo6g7/+0+f+MoUBKN9kYJ0vn
MD5:	F77DA6156A5EF8CD10F147AEE9335544
SHA1:	B089A4FC83E1A7EBD9F7D421DD6F06912041728A
SHA-256:	36B30F168E94560C3E725BABA61982DB409555566A3CC0AEC164F82440100DC2
SHA-512:	38A09CA073EDD64877222B7C13B31933A745FC2488F709660433218A27F3C5198C3C701B0571AF50D05B612E4907970F90011A070768217A4CD520C63F0EE3B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b9abc1f754bd406c9cd23d99ec7fd149.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:71672HJQUVc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.3611919051970665
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MKAicIQ8jFmShm5PKJ0vn:qgFqdg7/+0+f+MOx9kYJ0vn
MD5:	5AFF725185B5A1BD709C1BF791541174
SHA1:	C48DFA68A8D79B790F7A01E516FB4F8D34242E49
SHA-256:	0D90830BB6D4EA3EFF26436118A0B7F1140E2210A8602A0287AD94FD6451CBC7
SHA-512:	66331CDF8DEB7583675EA23A88E976BFF029EF0DBFB3C636B2550E509EB77F89861165C05681CB5194DDC200E038A6A54B0BABEDDDE76190DA9EBF984700A90E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa6bdb0ed1a4479b9a042771949977ec.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:71694W0GbEc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4630864484925885
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MpE1Ov8jFmShmatvn:qgFqo6g7/+0+f+Mq629katvn
MD5:	19D010394AB07ADEBFE2A67B4C21367D
SHA1:	632B07182BC315DDFDB712A4DB8D7369210603C7
SHA-256:	282DA5ADACF24D4924D7E999902DA9EE607A896F15C18962EBCE5B3553CA5127
SHA-512:	350856B771F1540DBE7BC51F990A014ECC1E424A1157904132D998F9499861DBEC81F9BBE9B2328BFCEA097AF2442CF9E8802A8C93778FE30D4C8D9B9188ED10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5871f1ec70bb4da2861a43e4a3536cc7.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:71696gQ9h5b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.449407659407481
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MQfQ2MuqjFmShmatvn:qgFqdg7/+0+f+MQfQ2MN9katvn
MD5:	828AAE70FE6D8A9BBEDDC99CA6378396
SHA1:	D32162C10115554584B0B48EAA5BE0A9947667C2
SHA-256:	9F0443D25B5E946D726872B633A2A09A531CEC44FF3F2B4367D893DD29499D74
SHA-512:	9F9BA0871E23E208B3D192F2BC06F0E9FE10543DA9FF31BAC1630A0A6E96C2E598F0CE954D4356D17C9D3CA062460BACA9A6A484D4A57E9BF4CD4AAE3B62DB2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e14fde628ef8450984debb3a71865325.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:71718Hv0Hoc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.421166182058347
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MofSuSHhTjFmShmzxvvn:qgFqo6g7/+0+f+MofSuSHv9kztvn
MD5:	35263563E552CB62A65754A74D17D9FE
SHA1:	1CC78B1CA8EA90F01E978F0ECB2DEAE3A674595B
SHA-256:	6D9A38F4BBFE902C95DBDC7211DE9C30674117E6E5201EE45652DEF14047E6EE
SHA-512:	7CBB26D881F8FD5EE1A9DFDD016E058BD01B4F62CFC031C701C2261B683E306BB3418ED15911A87CD611D3353A49C8CD63B1EF3826DCDB951742586C24D90375
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=be862695c2c94f86b7a22bf67b099fcb.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:71720FMYiye

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.4228306933670245
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoSKmefiHYTjFmShmzxvvn:qgFqdg7/+0+f+MoSKmeNN9kztvn
MD5:	C2CA4B162D2B7565EDFB5DD3AA4E565E
SHA1:	8D42E0255435CD021092C946D11E60334A10365D
SHA-256:	E84F193E5461BD8ABF71F4FD4527DCA191BD9A55E4559F112EC8FEF4D30CDC3C
SHA-512:	4977EF40FC6BED5FE14C1281CCF9B4D1309B80B8F7E8C8FFD8B0A1604E3435EAF9B0C7F19EC110707B7B0C79945BA7ECD9D6F036E744DE39DD53A2AD23074A8E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b85ecaabba9244168fed87598888f23b.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:71735kD667a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.38239384126053
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuHoxR/gqjFmShmZBvn:qgFqo6g7/+0+f+MB/L9kZBvn
MD5:	F04550EE2A09D2484816360235129A21
SHA1:	E9B432E9BC198763688F620063A6A7E99F56E93D
SHA-256:	739E54AB0C02BB14113F3AA3D5C3ABA78277C3F2A467DDDAF190D1AA7AF98FB1
SHA-512:	DDB1F8BD5EFF7D041C3A76F55BC0973719D214A64FDB105409131F0EBD646C0592691D04BE84BF2931AF581864FCCA2F8C4BC94C054AC8804A66CAFBDFF2600D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3d5f65db4c14409b1dde6c598cddab5.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:71736qetaOb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.377265167703362
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4muDxh8jFmShmZBvn:qgFqdg7/+0+f+M4mI29kZBvn
MD5:	FC40D795FDDFC97A50744E8B53367337
SHA1:	B7C92A2FB52C85D12AE33BEB0658A644983DA2CC
SHA-256:	F0DAB82C23720035849D28CBF668CE57426715CBB10EBF2A21BF854A479CA2F9
SHA-512:	C7818C7BB9E2ABBD1EA81BF94EB7B94D669D50AD1CF6C437796E62282FB63986CED57F5B7480DF825BCD43FDCB1278D60FCAE1E14237398940C6ED1F535CD3C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a9116d5782ec4b1c8db4acbae94e784c.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:71758xwTpKf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.411822916430001
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MABfjoMVX7qjFmShmwtvn:qgFqo6g7/+0+f+MkfjoMVr49kwtvn
MD5:	85B977CCFE34B7B07F18AE72A475312B
SHA1:	9BAB391F0DF1707342788A1D529F793737805180
SHA-256:	150E61477B77C0654E41B3CC389A1D2B43024DF2B8D16BB3F94E7C4F82A35D72
SHA-512:	926BD9BB28925AFA11A97633D2E7E5B3C73AFF9B341CED97BF313B5136D940F2E4E851BAA77919CBD27DD691C412AC1E778923FABC746B75DD47F3B45BC9AA7B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc8d88aa111448019868bf53ae85025e.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:71760t3XCjb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.444978738022877
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MkxjjFmShmwtvn:qgFqdg7/+0+f+Mkxd9kwtvn
MD5:	E4C48BE7A2EAB7941B59FFBE827609D9
SHA1:	FE1B6B1A7A994247C61AFF91E913BED8CD411D51
SHA-256:	15C9D0106F3DC83629F9A64245D448C2639C621E1B8C0F716CA5A4BFBCFF2E09
SHA-512:	F3DD2744D012078096C3997C23097C4C3C4AD9D514BEACF98A202E8422B1CB0F2813FD219518CDCCD27658F53FCCEF758DF120DAA014A60402C3CF789C33AF13
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=995df33237a440c482d2a7e0956bfb23.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:71778MCi0Pe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.443008620472711
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MilFHZoMqjFmShmkiEovn:qgFqo6g7/+0+f+Ma5t49kVEovn
MD5:	A23D915918011484F7AE88168E489A01
SHA1:	C846C2F81AB233AC2B730A0B7EE977C45CD9A9BA
SHA-256:	B00F7FD47E497AE76C344B873389DDE09CD5BB2FA63D6EBE5D82953F7DE5A211
SHA-512:	6344C7EEB60FC0740720C62486E380DE08A34A124A4F5122D5A5527A8464FEEB52A6870FD56546C14BDD1F8B0854217019ABF30501C3E9F871B06CA9BF76962F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aeb0da0c7c4643b2b9052818bb60a191.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:71779KrkMOb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.48066574928603
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsWM88jFmShmkiEovn:qgFqdg7/+0+f+MsJ829kVEovn
MD5:	A6275DCE9BA2C7B1B07CBD40EFADF4F1
SHA1:	B924C9F7F23CAA1813BED14FA8D10413F0C25B0D
SHA-256:	DE9ACBB22792F4ABB49D2F603AC96F22A38212512083664ACDFD995B2A832AA5
SHA-512:	0AFEBFFDE0AE99A57B5865377452AF584CEDA9762C00C16F75F6402161CBD63410FE31B8FB4CA019D5AE207C15693CA6B0A168738DB4CA1A687EA6C3AEBDFF29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a43fb173e9cc48f7aa929b581e372628.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:71781abKAJf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.4494780066452515
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MkVhJ+FQNrqjFmShmpvn:qgFqo6g7/+0+f+Mcb+q+9kpvn
MD5:	1C8C3784586EC636C28D3FC307A22206
SHA1:	A022FF04AD95D6C317315409483D9E2CFA051019
SHA-256:	797FD5197F58AF0B137F739A02E9CCDF87158BF0889DD4782DDB55D040E8E66B
SHA-512:	0A33E4D3BB9F3032422E8B2983E58216C19D267D013653B407781B722A51F1D91C8494F191A5B09DE544A4C91FDEBFD92CE122C4F77A20675C98D96913F0CA52
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5359086be6744e14b2291da6a74c8cb5.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:71782vnGCeb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.3784631225329695
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M5JSXDTaZjFmShmpvn:qgFqdg7/+0+f+M5JSXDTg9kpvn
MD5:	9D292E0F3D64BD3E1400B70DE3F408A3
SHA1:	7FE676CF04CD19A521C9EE596A2AA5865FDA7E1B
SHA-256:	25A96C8E36E02BB526EFA33A2AC6160374124B79960BF4EDA8FFEB3A4EED1933
SHA-512:	1BF6DECE8A2A373F41DA595F7786684382EA4B4D1D0116F17EAFA45D480CDAAA7E02E0C71E14A6C9566CEC9C12DAF9B1693BDFC210EE6E8F5A00A4D08C6320B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9c367fffcf334df78dda72fca02070a0.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:71789jq40Hf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4391187073302865
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M9FECcB0pN2jFmShmQmc0vn:qgFqo6g7/+0+f+MIk+9kQmtvn
MD5:	9B28D598C0E390FEAF553E1BE60AD1DD
SHA1:	BCAB0C1125AF394476B5F9D4576DCABAB147CE50
SHA-256:	BC1B8F05583AB1F7373B60A437F3CFEBCB9581EFD0BCCB55258B2BF9313A28F7
SHA-512:	3463CE95AEE4FBD2C18172CB979039049AB77AB4D22F17F6C31E6A649AD1F289B15AD08E493684AD00DCA68F1615F6998903E930D1250B3C00AF683974CD8376
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b4bc7ec25564074b0f8c0a1567579be.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:71790GgvtFc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.464796200977451
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MucG7TjFmShmQmc0vn:qgFqdg7/+0+f+MTKN9kQmtvn
MD5:	FB8A96B2642FC1F035EB03B7EC071DFC
SHA1:	619D69608FC8E6D3EB1D87378B2549C0DC3D3ED3
SHA-256:	0E6B338ADAE73A772DD08C0EACAF4132C6577180C44B69323D089E7C95773755
SHA-512:	9FACAFE719417DEAE3800264EC0819C827E93B5FAD356971DB08F8C19B16D3045E2392A5A449540975F13CA0F63502C2491317A00E13BAE914D310EF7BCDC008
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39343366d5df4f24b0c492b73ccf4b72.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:71814PaBLte

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.467454266138637
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4OnjFmShmx+0vn:qgFqo6g7/+0+f+M429k40vn
MD5:	7C654A10F818F958181427CBDA151A82
SHA1:	4AE0D27DDAD6C38340A05697BADF3F91A20EA10C
SHA-256:	5F7CC7493C17376EE8CF3027190C39B10F85441EBD76BC7DF2EBDF76790A52AC
SHA-512:	6E91BF4FE20FC17D86688AD545173E2A7CFBC8B395E789CF65418B7F1082248F3697CBD6C9FCE37D6738A469AABC03B3EF47C85C781CA04B3750CE19E22BD5FC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22b873773b0847fd901036bc7bf4348b.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:71815wEPV1d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.405017173739617
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsKrEvdl2jFmShmx+0vn:qgFqdg7/+0+f+MsKwlE9k40vn
MD5:	4ACACE59A236A4ADCF71B5FBE1E67F05
SHA1:	2AF13C04F53ABC8F79F6616F830D98B9BE835BCC
SHA-256:	CBC462F63FDD4D90DC751DCDA227666509AFE21C8C96A182268E9CF974324855
SHA-512:	90CA5BF111A13DEFE951956A8AA0ADDFA7686BDDC42ADCD5248BB562A1974D5DA7DE141077D5E4A43B37C9FAAD535FE6CB7A28DB8101BF402FE11D560796AD80
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8b38bbcfaf046ae89f4140dabcf38ff.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:718375I3qjc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.460953064363246
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MNdUYURAUjFmShm3vn:qgFqo6g7/+0+f+MPUYuAe9k3vn
MD5:	04F36F79AB19E245A92B12D77C443ABA
SHA1:	F4B9B40BEA78E5F1AF8E58FDE8C5FBC88DE5E7E7
SHA-256:	1F9638975D99171705514F4FD3FF4FAC81FE78A85D46600C6107EDFE734D8E99
SHA-512:	891153696B55915304F6E602B7F1C8D174B8BBD52B9519D455BE89FFC6CED1A0DB60FA26869B836DEB02BBBDD2DEC86064E3EB0993316A76CC83FDDDCF05E75B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cbaf8a93ca814f5f8af2d633f947289b.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:71843CK4ddb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.394267800250053
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mos+y2jFmShm3vn:qgFqdg7/+0+f+Mol9k3vn
MD5:	FB97053F2A0FE14E9018AFD67C7BFD87
SHA1:	C39E2173DDEFAC7CE26A3A53AD021B9691909225
SHA-256:	08CC315CE87593580597CF475DA7AA215763D2199CA62104575D8A72CCB4874F
SHA-512:	67FAA281A832D72D8CC3C2FD7C02B1EE40C676896914B2728DF64575C54022B3DC7FC89E734D1ABEB3256CD61B3D5F1043BF01F4014011543F55AD9E6E02408D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b0cedcc836104d4eb4280029edb463fe.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:71850iefCXd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.391050311941809
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoTRf3pTjZcHdzqDq:qgFq6g10+f+MoTRfLmQDq
MD5:	7DB248B97A50C5903E10A9104CBC28F8
SHA1:	B846142587D78683A7CF7A3053ACB21953C2BE06
SHA-256:	750C23EC03C10AFD253B501E75A75B801C39302818C5C843F84B8E6D279CE96B
SHA-512:	5B8A6FEB994E395912627D7E71D7601E34F1B026D2BDA439CC48D08B706713C9FD21A86E92DE7B72C5E2C0ACF5E778B3CB8EFAC34463C361136D29606B1259DD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b361bf11044a4d76a04711a6acf900cb.IDENTIFIER=systemd-hostnamed.UNIT=systemd-hostnamed.service.

/run/systemd/journal/streams/.#9:72054Sg5A4b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.3944123426459525
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrRPTVART0WdcsbQnz:SbFuFyLVIg1BG+f+MEVFJ0R3RqjXjK
MD5:	41AF14131F127ED99BA2FA58E97C58D1
SHA1:	142AD34B17BB3F245DF6BBD379DCF643E6CA9923
SHA-256:	D60FD0D5BED319F9C27C40529760B581BB2780C682470742749F4D7CE64094C9
SHA-512:	76C59BFEA2E74DD36FF86CA2E2AF32914B5B80578356895EACE5D789586313AF1D8A9B4C0F6526657AE42F8629F61B8D46AECD21F9D408C64F58CD6A79F91F59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a6850e060e484b13895ec7f4732bb4ac.IDENTIFIER=fprintd.UNIT=fprintd.service.

/run/systemd/journal/streams/.#9:72068L58j0d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.355554584046557
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmriMOF1Rxxzl+sjsys:SbFuFyLVIg1BG+f+M+jF3pTjJKJMBNr+
MD5:	8F08F39792D492125514474BCE8F3FBD
SHA1:	8A966841739C2BBFC6801C2536C9905CE4BF3D02
SHA-256:	220A486E985F8CBD9565FDB974DC1326E46F57D3FEA73407C586FC4F259564B9
SHA-512:	7A00AD6A6975995AE26001FF7997B0114FC4C4154F94D7898F7953F616A48AE859AFC99BBFE296BDCF3EBEB934533543C93B1BFFFDDD96F5725A9E63FBF4F258
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4a2c807c01b442fa9527e64dc4a77ea.IDENTIFIER=colord.UNIT=colord.service.

/run/systemd/journal/streams/.#9:721116ZRrmc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.420809521816483
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxms5lXXLFpgXWE72a:SbFuFyLVK6g7/+BG+f+MsTppeCjZarvn
MD5:	FA830652DACE58A119118804D45F3787
SHA1:	872F6C5F60BE0AFED0C2E6D58BD4FF25CFD2240D
SHA-256:	A277A439FFF308DF426963025E80975FDAA39DE32815B99011195421809D8E77
SHA-512:	51B792296D99C45D3DED0E19C63DE87808FDE4718A4F2A7664CFF25A3749BBA8E2D34A5E1C3A09E2A4F09AB82F32AEDD2141CC78750396CE4F93F9A159F44497
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4007f522e4949f383784c233985a515.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:72113v5BHZd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.38752623663576
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsCSHzBkaB0jZarvn:qgFqdg7/+0+f+MsCq9karvn
MD5:	FCA3C7387547BAD6D67EF3FDD2184304
SHA1:	9111F45C1202EAE458C078312D0E378A21AE67D8
SHA-256:	C1E727C42CB34C50FF385633D450D976212E3846117E6714B729A1DFCE7549D5
SHA-512:	1667E8BEEA68A9242AD7A46AD346B091ECB393D6B1128F8540C8A298E85250842EFC09D3C6DAC9D04DB643E5B4A0909E1C42FBA8F653A5F88985EEB31B10291D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f52742175dab408dae8c3ba818b0b6bb.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:72143WAqbfc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.34248232182742
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9qTHkQFFlsjspHZ:SbFuFyLVK6g7/+BG+f+Mwx8j022vn
MD5:	8FE8F65E1E810D756A8E8CA51D69F704
SHA1:	A9D815E3AA1CFB7DC4658D16317E4715088DED7F
SHA-256:	88839BB527538256E294EFFD44BAAE5A42BB979A0590751FE43B8AF5D1482101
SHA-512:	0BEAF6A4E12FBE08C9D8358F1BD5565D759D544ACCC91335A7AF0B1485B3CF0D213B96D5B1626ADA90BBA35519CA992E7541DF12D1276890234DF75B885EBDA8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7556ae4e6d224861a9112ed1c62902e0.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:72145Q3sdze

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.350007548067295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpnlDXXtjVcjkws2:SbFuFyLVI6g7/+BG+f+M/X1Vcwj022vn
MD5:	AEF03DAF134BF05351DDC93E907E8FF6
SHA1:	37E615A3AF9F9000F2958FEE88D8ABFD3B180F28
SHA-256:	E3C0D3201106F431C4A36B859CF853BC6C10D866F9A0555EF24D4616CB4E32E1
SHA-512:	344DEE195343BBCF52E7178E353534E668399533C48E49296483DAD825F150B8090C4D09693C915C7598F0282965BBB620424EEB536C385347E5BAC5E2ED0EE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3eb738d22cb4a09a0576c77cece8ec2.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:72191PtF1qb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.402172948807663
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmubQQSb+ef1NvRqjsp:SbFuFyLVIg1BG+f+MusQSdf1OjhD1DTu
MD5:	B10A1D0E4B374843AE9008F3C72285D0
SHA1:	EBCA2B6A76D854D06DA2592D82AD4ACDC9C92478
SHA-256:	DC3B1F10506F17BEE3E66C0C6DF2BC79A9923C1BC4BD5BF8261C56DBC42F575C
SHA-512:	0FE4C3C76099480E0B2A0AE375CD2DB5A859E95406E9712819774A4EF5A58E99F0DDF9366727951B9D0A870D3258F3CF9437D0BE03F38BE33EE806398B2CC9D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dfb68c05739b4f65a46e0cbea88486f4.IDENTIFIER=ModemManager.UNIT=ModemManager.service.

/run/systemd/journal/streams/.#9:72277ZZrQBf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.359740966827181
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+suziLMY+sjs1Han:SbFuFyLVIg1BG+f+M+9ziLM0joa
MD5:	AC80438ADBACF5637D84C6A69FC5ADA0
SHA1:	00BAC8CB9A4E5C9A2A22D8BF8099FF44312DAE2B
SHA-256:	C527B3986116A957C06639996603F6CBCE0D46EB47BACB8ABBAF7735F7AB5328
SHA-512:	48C6C9F8C146165EB92D234466BB3BFD70447A047073665E476B566BEAF8B9AE9453CA2596269FE2F92D093CED407DDEE4E2D733BFC528942FA5FCA0B14D8648
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4909c8b5b110400ebab726386d90f9b0.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:72278LyBREf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.332118668530091
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4RDcR7nqGhHpjshQJ:SbFuFyLVIg1BG+f+M4lcR7qQpjtWL0
MD5:	79BA3F56B38D620BB0CFABF8412E8400
SHA1:	B5B7F01F2F325CD47E266124A5CC3E9BA2172F37
SHA-256:	6EE342D0DFA4C59406D6E76ABB0C5D8BB2591553B0AA32E4B3653B597C147297
SHA-512:	D9D2B786572CD7B196FE4D665FE6EB8B601F332757F4D8FAA4E7E548BBFA395042BD48388E6CA2F9E3874A2FBD55D0A5D6AED7DFFB14F29C23B4E42F4409870A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26a09b2fdd9448d995eecbd498b0fabe.IDENTIFIER=pulseaudio.

/run/systemd/seats/.#seat02DZezd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat05UTqYe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat08cwoFd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0B8LuOb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0QsnCff

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0XJS68d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0gcN9Td

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0ibWWeG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/sessions/.#c12G9Gqc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.418445172263165
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBpG5JgDpWe/lE:qgFqPuFN6IG0n99x2xayWpG5JgDpWe6
MD5:	FE3B393403B7862D030C9BDC71E807DF
SHA1:	ABCA30FB60C1FBF9B8C9D620F62105F15EB7277A
SHA-256:	13AC45694CF96FF3EF084919DFDA9517D7594603D024E04FB90DF69289B0B40F
SHA-512:	58584CD7DF05E5A1FB28F65D21FC27CBF324B470779F731C6A0463B85AC0C7767834A729E8A4175FBA4F26AC5F8BBB36344304F5CF255CA069FC6716AAEA7D3B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.

/run/systemd/sessions/.#c1GSZb6a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.418445172263165
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBpG5JgDpWe/lE:qgFqPuFN6IG0n99x2xayWpG5JgDpWe6
MD5:	FE3B393403B7862D030C9BDC71E807DF
SHA1:	ABCA30FB60C1FBF9B8C9D620F62105F15EB7277A
SHA-256:	13AC45694CF96FF3EF084919DFDA9517D7594603D024E04FB90DF69289B0B40F
SHA-512:	58584CD7DF05E5A1FB28F65D21FC27CBF324B470779F731C6A0463B85AC0C7767834A729E8A4175FBA4F26AC5F8BBB36344304F5CF255CA069FC6716AAEA7D3B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.

/run/systemd/sessions/.#c1UTJOBc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.482219932945656
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffyBxfx2xNIByy6GBpG5JgDpWe/lE:qgFqPuFVuRZI4BaB9x2xayWpG5JgDpWj
MD5:	67925F926BC326227000FA42742576CB
SHA1:	54509243E8508D04087BBE0CBA2041A36C672F89
SHA-256:	0602C5EF45032186570349D299B25ECC7C9DAD21582DCBB984CBDE160F86A038
SHA-512:	C773291DD35232F6006D3397725CA4F9F188C51B91DA95542D642C9CFD038D9F17BF0628CD2BA2C353ED9D0085F42D75C163D89880535F11CDA7B0EE391A9F5B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8257.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.

/run/systemd/sessions/.#c1Vqgqic

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.375198658504809
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBpG5JgDpWe/lE:qgFqPuFdDJIi9x2xayWpG5JgDpWe6
MD5:	5A4B894F623CA3243BC944BFB407AF5F
SHA1:	7E5551ADC8CD318C02E905D36208BB0468E3B572
SHA-256:	286047C54175100BD4DF8B68A65CC8500A2902F5A55C42A6C75DD2A73AAE58AC
SHA-512:	4C9D3442072A619F1B2EE4D8790BA4BA0CCFCF9D7FF2A432046557DA15D3E359264CCA1DCBB1046A9DCD9A5B36A91B79E3021705BACD3750266D608C8FF612DF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.

/run/systemd/sessions/.#c1rd5gVa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.418445172263165
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBpG5JgDpWe/lE:qgFqPuFN6IG0n99x2xayWpG5JgDpWe6
MD5:	FE3B393403B7862D030C9BDC71E807DF
SHA1:	ABCA30FB60C1FBF9B8C9D620F62105F15EB7277A
SHA-256:	13AC45694CF96FF3EF084919DFDA9517D7594603D024E04FB90DF69289B0B40F
SHA-512:	58584CD7DF05E5A1FB28F65D21FC27CBF324B470779F731C6A0463B85AC0C7767834A729E8A4175FBA4F26AC5F8BBB36344304F5CF255CA069FC6716AAEA7D3B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.

/run/systemd/sessions/.#c1sn7Bnb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.433983843990705
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBpG5JgDpWe/lRn:qgFqPuFN6IG0n99x2xayWpG5JgDpWeb
MD5:	80087DEDEBF08DAEF2D81BD0C02AC991
SHA1:	8003182708D06CFB520EE81EDD9726943855AD08
SHA-256:	1DD6C88F9754375BCFD25E7163E23B8F44FD7B9664274D3F00136856B5E09A2B
SHA-512:	4631B6C2878685CB033B006EA9EC47AE63B290707EA5CD5604DBD279ED20E6E9CE8C6B45969DCEA8C1A0777732980E07FCC53874D995093893F7CC642FD08C0D
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5787.REALTIME=1736206100670126.MONOTONIC=131837349.CONTROLLER=:1.9.

/run/systemd/sessions/.#c25Uzi2c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.434312032167545
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+g3:qgFqPuFNuCH0nI9x2xayWZJgDpJg3
MD5:	C7CC7E16E7208A10472015FAB4B05253
SHA1:	B50E2EA4161F11F204D71D52875F0402EE0F7201
SHA-256:	AE0C50A897189DD3D9FE8007414F9BCE53B9DED4C50A74DD2B643750FB171F21
SHA-512:	04D6FA2A2FAFA7268D0F49D080D0F037863927DEF2D9B6B5E5DE528B2DFB614A65A0C3817B44AFCDB7B9FE2D4B59B32192D447AA6A4396F6A4C20DAF3E69D604
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.CONTROLLER=:1.13.

/run/systemd/sessions/.#c2CIpf3a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.478720303434802
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffU8xfx2xNIByy6GBE6JgDpT2+6:qgFqPuFVuRpCvBs89x2xayWZJgDpJ6
MD5:	A075F9F482E456FAC94ECAE5D69D375D
SHA1:	7C421096E454850CA9C476B3E6EFC66F70DEB77A
SHA-256:	F07DAEC2DC38B93A17A732DB2B0A2E3A4F99B61358933813B28A89E2DA44BD67
SHA-512:	B622DF418B7006F47CF9FCA55E785478D73F722758E8190885D1E769647EA2208944EE44E0882D03E2EE8C39EAF7C68F235AA5D61BE785E0D201DBF3A2427F53
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8320.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.

/run/systemd/sessions/.#c2IrPeyb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.4395504710349725
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+g8i:qgFqPuFNuCH0nI9x2xayWZJgDpJg8i
MD5:	303A289A9A125203FAA4E1EB37FC9F2E
SHA1:	59D02B63A322E2B569B4C783CBC62F7609C89509
SHA-256:	EB6F8264467D0FF0785D30E19E9094F1E8094AFE0FBC1E613CAAF49B77D76177
SHA-512:	4C2D9020646B24873A2EBEF5BD62A07BD8782F167CDC409DEEC8A987765463160EC5347F828859AA1D1362CA4663BCAA650818D6D6376A87848E7471D7D873DB
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.CONTROLLER=:1.13.DEVICES=13:64 .

/run/systemd/sessions/.#c2Q6H0Xa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.454641940796392
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+g8wn:qgFqPuFNuCH0nI9x2xayWZJgDpJg8w
MD5:	6A655B09F45B067C0282F94C72C5E1DA
SHA1:	B486A004260C0BD701AAB3C99E3CBCE2BF27E0C1
SHA-256:	043ABE463A705F1C1DC3A1F1771895E4630E5D369F6A7F2F05B4E0B2490EBE57
SHA-512:	900631FC88CA08B54DD506E6B29A611D40C10F1C0DFCF280385E1750C7EBD7DDDFBD5246C23DEB3F65DB6DC899C441D701744B2C32EFCBE3C875B6B3F0E2C6CF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.CONTROLLER=:1.13.DEVICES=13:64 13:67 13:65 .

/run/systemd/sessions/.#c2a6THGe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.425585146947923
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+6:qgFqPuFNuCH0nI9x2xayWZJgDpJ6
MD5:	E7FE695F30B18D945A84AF1E2454524C
SHA1:	A090845FC6CF8420698DB8FE8F4603F666FC9824
SHA-256:	67150526D224CB8095A100D9E2EB9D5977DD323E37D4963D1B2FCE398A1063F0
SHA-512:	C96FB4851CF2519880EA6666B19E40082E634BD8CA0F05DCAF26F9926D12EFB68F0FEEEAC3B67BA101C128322812D49C34322FAFDDFDAB433FEE465E8F2C93F2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.

/run/systemd/sessions/.#c2gFKrFc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.425585146947923
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+6:qgFqPuFNuCH0nI9x2xayWZJgDpJ6
MD5:	E7FE695F30B18D945A84AF1E2454524C
SHA1:	A090845FC6CF8420698DB8FE8F4603F666FC9824
SHA-256:	67150526D224CB8095A100D9E2EB9D5977DD323E37D4963D1B2FCE398A1063F0
SHA-512:	C96FB4851CF2519880EA6666B19E40082E634BD8CA0F05DCAF26F9926D12EFB68F0FEEEAC3B67BA101C128322812D49C34322FAFDDFDAB433FEE465E8F2C93F2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.

/run/systemd/sessions/.#c2lK4eFe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.449401614036527
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+g8nn:qgFqPuFNuCH0nI9x2xayWZJgDpJg8n
MD5:	233D7EB473A6307F4C470136D85B49FC
SHA1:	7AF58C02977CC9952B4F41DE11E1B01E324D590E
SHA-256:	0983E62B869D9C313E1B2533582FC5C93D42C3076478F3D9DAD959B6AF6A15A4
SHA-512:	898CC335B52C74A56EB82A2057E8BCE48111EB09526F2DD9B9A889B449F31F1894C9455F68937CC2C4B5A4441F23AE6970F10E5228EA92735DEF59DCAF0FD4EF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.CONTROLLER=:1.13.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2waJcWc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.453898274514126
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE6JgDpT2+g8Tmn:qgFqPuFNuCH0nI9x2xayWZJgDpJg8Tmn
MD5:	E5211B6DEFEC55F5654971BDC5B6E9E7
SHA1:	02ACB8C7F76CE4C1D8F7C7304EB3ED63DA9F903D
SHA-256:	3BDED979418E8E5052EA8AB37B061A1DB2583B3E7D043F95857B759188D59504
SHA-512:	6EEC802B356423581A230F1E61AC2F29235A8261081C774CF3956B93BF27238136CA02DC98584609A5E5295F1E8A00A1EDF7950B08A67C95E69C31628F266C82
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5825.REALTIME=1736206107093409.MONOTONIC=138260632.CONTROLLER=:1.13.DEVICES=13:65 13:64 13:67 13:66 .

/run/systemd/users/.#12750SSic

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.130502359893152
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDpGrKjN2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegDp7wthQHtPnmDq9x
MD5:	9C1140B61299BF90E32AEDD18553D6C3
SHA1:	02F420613A8226488259A44B4F84ADD3FEA1205A
SHA-256:	B3EE39AAAEBC58D67DC7730809A96866313565F957C57F144B88B81C25C43D2F
SHA-512:	29770E13574537B1DA8CF7A5221591353FB7F17D4A17C466DE71ADA50BD18948BEEED7E0E93A2048F3FDF411FE7E9C498B2FF5860EBACEF46E3A13088BE9606C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#1278smwtd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.275701617458405
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffy35JgDpGrKjN2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBKJgDp7wthQHtPYq9M
MD5:	D72CD4089207D0FBC6BCE9885623550A
SHA1:	BF7F90C1140033534D8C4713977337B7967AA222
SHA-256:	4D7F1129C90829213770CEAFB199CD7D7BAE7E742D8E6A81CAD011505852A1AC
SHA-512:	5A781A8C2704DBC8E2038A1CB4ED1E4C3754A4422D1DCE4EF194CACF1DFE1931515E604936D8ACAE6755441B642CF48185F110ECE6C52D4DAC63A057FBCD25CD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8195.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127FeHiGa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.120068794668942
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgDpGrKjN2z5c2zw02zb2owB:qgFq30z1cL/iRJgDp7wz5HzwPzbA
MD5:	1EA09547447B612753CB5041D9F1EBC0
SHA1:	32FE26C99FBB4379E874A78E9A7C9F5BC970016F
SHA-256:	7EFC718FEB1FAEB6FD2E4FE7DE95801B537A1F8E44274B1A6AC70A6EEE4448F6
SHA-512:	81C44812A39BF0239BEF3DCDB61C677149F661593AE69BA5C6005F55A9C656BE2E3661AF1796A148E7D98FBE6FD56092BE065C97C8DF6B34F5BFF71FB2B09716
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127LOhF3b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.276943444428929
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffy35JgDpGrKjN2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBKJgDp7wthQHxbPYA
MD5:	BA43D9CDC359D844E50F9D4FC4474697
SHA1:	238F29731C791FC79723AFB3F6A79BD44A8CA969
SHA-256:	34446BAD5D211964FE6293053F76EADCE5FEA6F293DE4BB5347637F265C51111
SHA-512:	A0CA24AFC1D4331B99EA93B87565A1A36126670E4DD4BA7AB33A900E6EBEB54E36F4FDCCA4C7EFF8EAE16F703E4AEA547CCFB2BBD2E0B80B999F88F7C2FEC20D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8195.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YGMf8d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YWi4df

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.120257105162871
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgDpGrKjN2thQc2x9sS02/g2owB:qgFq30NzL/ixegDp7wthQHxbPYA
MD5:	5C5B7F27DE5503E81F8182A41C72F533
SHA1:	93FCB39AE7FB32F544434604F3F3F0B5A1F6F5BA
SHA-256:	E8B1177781EB3C90ACCBB2B9D090D806EE6CB917BF0F7C0B8B243F4C6C4E33DA
SHA-512:	A0212D569B6F85C52DC924E922539318F34858C401D9874ED2A93270080F24B61F7CA9ABB0B108343E6710D301756ACCEB78FDF4CCBA846C2EF1F347C662F544
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YdbFve

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.142100048637226
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgDpGrKjN2z5c2zw02zb2owB:qgFq30z1cL/ixxTgDp7wz5HzwPzbA
MD5:	25869E9A9F1523D8E9BD9E859F2402B8
SHA1:	9663A0342318776ED5035480E875EB1CBF06D21C
SHA-256:	8045B154C1276006F226F28681FD51810A1B3941F346B4E061A2F639B0F6124F
SHA-512:	5C4827E9057FBFA6622CD0EEAFBE00881B8F70DE15E86E1433DD3F079A4A20001F1328E142035DB94E168253936E31F8A297EF9205AD0F26358B6E38303CF467
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127iPauDd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.130502359893152
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDpGrKjN2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegDp7wthQHtPnmDq9x
MD5:	9C1140B61299BF90E32AEDD18553D6C3
SHA1:	02F420613A8226488259A44B4F84ADD3FEA1205A
SHA-256:	B3EE39AAAEBC58D67DC7730809A96866313565F957C57F144B88B81C25C43D2F
SHA-512:	29770E13574537B1DA8CF7A5221591353FB7F17D4A17C466DE71ADA50BD18948BEEED7E0E93A2048F3FDF411FE7E9C498B2FF5860EBACEF46E3A13088BE9606C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127jdmOse

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.295935015619533
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixffyhs2jSfgDpGrKjN2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBKzegDp7wthQHxbPYA
MD5:	839D80F04DF4F96544CE0A26C87D1336
SHA1:	473878F75CA60F40C43168BA351A246F7CCE1885
SHA-256:	F4D35810BC9C08FFE8BE504428AB15AA0F7D2B3127147A3FC7C0E636466D39D3
SHA-512:	6DE62142DC73F18A023664289F3F8D1D984B843DA03B16433A4CA262FF418592F882BBCF647169A9F5E987240BE01FB355F31573CA9B9B29C0D56B2AE57C1BCE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8195.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ksCSLe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1361933601429515
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgDpGrKjN2thQc2x9sS02/g2owB:qgFq30z1cL/ixegDp7wthQHxbPYA
MD5:	67EFD521A62E35867D6C00E6C397DC29
SHA1:	42810DA9E0CA255B14EC9D86A764B8488271109D
SHA-256:	9E786FEC66A91454C8A0C06E5454C95355F7E69D3BC3AA32D4C324C6A106E8F1
SHA-512:	D54FC868A7609A4F89DA88BA3373FC03FD167D137C08413E9145142472E31ACC787ED81D11F856AA570E2DF8649375E566B663CDAA66B456E708ADE0BDC4455E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oPSXeb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.126163793657145
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgDpGrKjN2z5c2zw02zb2owB:qgFq30NzL/ixxTgDp7wz5HzwPzbA
MD5:	48516048BFAF7129C0EC2283A68C0399
SHA1:	A28722F2743D64B5A9EE801123DBC5ED268DBF6E
SHA-256:	252C39ACAAE75B6B2316F7ACEE4AF603FD91A38EF259858A9EC9852668B7A1D5
SHA-512:	FAE29E94345D0F995C899DB3790BEEBE5FD516829B710C07AC57B523F3D5930A870DC6BADC0C8A164D8C7877CB841154BEA7C54764E6E99325CF9894A542E698
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pYLPkc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.140705718981426
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDpGrKjN2thQc2x9sS02nmD2owC:qgFq30dAL/ixegDp7wthQHxbPnmDd
MD5:	6A255DA2C95C5A598BC727C6F05CD2CA
SHA1:	E078FC5FDAD70A5634A5391F65B58E0DC90ACC1C
SHA-256:	3B95E9ACEE546D8F24E03904BDEB6C58842B49D6C52AC3246F55861E187822A2
SHA-512:	B60FC6C6D343C159596227155ACF7F775DCCE54C41E80BC21325867547BE1149DAAB6E43F083DBC06FB94E1B9E336AAFD13C9C0AE619773E3FF7FDC697880212
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736206100661902.MONOTONIC=131829125.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Qv:Qv
MD5:	BF7B7356D755DA622F5BCEA001609E65
SHA1:	060375A67AE9CD3562EA6CA3BE5335458BAFF116
SHA-256:	806DE16BE2AFA49B3EC537D7F5E718B71BFC6294474D40F0BA1C2BDAE4E8055D
SHA-512:	4CD72390455CC898D57D86F6A5A2615DBFBAD6E3E97D80B4F05DB14E403E0E07E3F85B6BFE4139E21C5010C04B4391D71892F592385CDD3D6FAAC525929FFC20
Malicious:	false
Preview:	6658.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.008832251430025
Encrypted:	false
SSDEEP:	12:OxP0xhq2x90veY+00LxP60veY+6dSmpMxPDQXwveY+D44xPUBKiveY+U3BQZ0vej:ZVx9xzp7XIr86BPav1k+17pP
MD5:	F72D9E5D2D41E1B8F240AE40BFFE7A86
SHA1:	D673AEB637CE8932A8C4409652352E931077A1AC
SHA-256:	DC9307BA29D9773A2A0EB3BFFBA1A42CC1456C119A584A5A71659B6C8D22A471
SHA-512:	460385BB6B5717D88EA7FA01C0D907E745E72853C1758196A07A0BD4D09BA5E92ADB51071929908F17A50EB5AD25FD474A11590C1100ADBE23D3CC0BBD85F163
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5850..MIT-MAGIC-COOKIE-1...d..t.yIMw5%.[.j..XSMP...#local/galassia:@/tmp/.ICE-unix/5850..MIT-MAGIC-COOKIE-1.....n....V.}...)...ICE...!unix/galassia:/tmp/.ICE-unix/5799..MIT-MAGIC-COOKIE-1..n4...k2....m..p;..ICE...#local/galassia:@/tmp/.ICE-unix/5799..MIT-MAGIC-COOKIE-1..T.fa.s_.+..%W..XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.944833248737333
Encrypted:	false
SSDEEP:	3:rg/WFllasO93/I9t3gwENWFllasO93/I9t3e:rg/WFl2w9FENWFl2w98
MD5:	4FA8F64145267E855190BA92A1377348
SHA1:	04C2A1A19604F64FCE15D9E57A95E811A8812679
SHA-256:	2316C519F9FBE00C890389ACCDE30FD5E86F7F403E4F66CDEA98745A63B85831
SHA-512:	96AAE0F04C031EFEE5418F20AC1442FA74D8E2A35216666DEC1D772391DE05B9A195CC76B34F83D72593D862CCDCBDDEA812C5B513A51F90C8E843E9603C2713
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1...}.@f.,V...5.......galassia....MIT-MAGIC-COOKIE-1...}.@f.,V...5...

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:5Fn:bn
MD5:	B6E5382BEE23CE918D577AD435A127AA
SHA1:	5C5A232BE57EADA28868EF6EECA2144C3E6D4CFA
SHA-256:	F0A95CBC241B26D75AD33B8009BA63E55AFF7696C213E6835CF5272BDDB6436A
SHA-512:	3D6FF23E36FCAD1A6B8DE5194C3FC760EC82006E0E8B71AF990053731F74478FE87CA481168C4FA159A1AF5688746FE178E043CF222A60DBC855E82410034906
Malicious:	false
Preview:	6110.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/yC6ltl:Rlv+yl56X
MD5:	52E9EDB61168FFE478F1EA59C14A380A
SHA1:	2A1C11BC158084B68A924F01AE51536EBC4616D3
SHA-256:	FD67DFCCB0BA03E3515A433B28F0EE833ABF51B4609464C8ADD6E0A82AE68754
SHA-512:	45E9FBF89AB889F25BD58551A40B0C3573573598F88804E2C15186E1DFA7B63D55AD244965AFD07DC0588D567D81B345AAEF60BA8DE0A8429862F69FB9B5C563
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................g\|g........................................

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.8M7VZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.C0XUZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.113833369297957
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW4y62R1Du+i:q5sU3LWfLUDmQymqSFbfomSqyJjDu+fK
MD5:	4A9B6497E95B2142E806DEA1AB1AB4A4
SHA1:	9913E6FDE67F242F1CDFCB58CD8F58F45FB91A27
SHA-256:	AB31B0193A9F45556D288BBDE87F932A7B0C2B2642B9E985242DB636CEE4EFCB
SHA-512:	2C620869C4C69818202E7F4C94C6BA1C6B9632313E3F1C266F2D4594D16DE085A8E3C1AFA2912B976F6D586B4F25428DF4DF0F43269B4C5BC453E6C249F7E118
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-yluBeWns,guid=a3c48380d468d1a82be6de53677c6732.IBUS_DAEMON_PID=6001.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.282944591371693
Encrypted:	false
SSDEEP:	384:SlwgqObQv3Mmd3dFdWdIdNdIdHdhdwd5dsdmd3dddAdNd4dEdKdFdZEdTHdUcdea:cwgqOEkwbXxk0p8Yo5PN
MD5:	02F21210D94CF9B4C78216B60E474B66
SHA1:	91638DE21FD8109463DD457310422E75DDC0DBE7
SHA-256:	5A0DD2714ACEB9A59B236B2C48DD118653E0F6AE4C7AC142936015E509074C50
SHA-512:	2F7AF99E2981EE9197AA5BF19D671F4B0C97960D61E818E86C51556BF2A3ED91052F2F13612ABE9DA6E0E0EBBF95D061626FF43B591F824BDEA6E1DF162F8DA5
Malicious:	false
Preview:	[ 138.894] (--) Log file renamed from "/var/log/Xorg.pid-5834.log" to "/var/log/Xorg.0.log".[ 138.918] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 138.930] Build Operating System: linux Ubuntu.[ 138.938] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 138.954] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 138.973] Build Date: 06 July 2021 10:17:51AM.[ 138.979] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 138.986] Current version of pixman: 0.38.4.[ 138.992] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 139.000] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2210
Entropy (8bit):	4.974659215745646
Encrypted:	false
SSDEEP:	48:6VLVOVIAVImVIpVwVLvmVLfVAV20ChkQ5TFTqEMzErboLrCjrCn:+h617YgLviLfW+MV
MD5:	FA2A00D2A5562C5650CADB992F862438
SHA1:	3DEEFD0649C75C596DF397E78B8C3D268CB4B940
SHA-256:	E08C9CEB86FA2A71C42441E730D299847DF74DB8199E32A3DA7CA3EF20DFD301
SHA-512:	4E3D0D5DBF064E8A047020353956260E03FF9FA69E9ABCDA981BCFC0F5CEE6E6B1DA9BFBF8AF142F49380B2C12349B2FC14E6A3EB3721BFA063D70F32CFB67D6
Malicious:	false
Preview:	Jan 6 17:28:08 galassia systemd-logind[5700]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 6 17:28:08 galassia systemd-logind[5700]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 6 17:28:08 galassia systemd-logind[5700]: User enumeration failed: Invalid argument.Jan 6 17:28:08 galassia systemd-logind[5700]: User of session c2 not known..Jan 6 17:28:08 galassia systemd-logind[5700]: User of session 2 not known..Jan 6 17:28:08 galassia systemd-logind[5700]: Session enumeration failed: No such file or directory.Jan 6 17:28:08 galassia systemd-logind[5700]: Watching system buttons on /dev/input/event0 (Power Button).Jan 6 17:28:08 galassia systemd-logind[5700]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan 6 17:28:08 galassia systemd-logind[5700]: New seat seat0..Jan 6 17:28:20 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 6 17:

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4480473215248109
Encrypted:	false
SSDEEP:	3:F31HlMchepX0cheZ:F38cheOche
MD5:	E007E0A08ACB2B6ED9034810CD251DFD
SHA1:	D6BC2DDAB6E44D01D9601954F73EA85B562AB8A7
SHA-256:	D6E4E830F3C8A15181A25B28FA8F27181FD1F5C1B465B985F9B67653E9A70530
SHA-512:	9E79165A5AD3FC65C83BB39879503EC88C295F79F89B769BC9DBC3F29A17B2A4414F9F4E5ABA160A8C478675C71C625A08F4728E41F6A99E13B2EE8C30BC37CA
Malicious:	false
Preview:	LPKSHHRH................}$..{.Ie.fA...X.................................}$..{.Ie.fA...X.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HltY/l1olX:F3q/
MD5:	405E486F2FB9C702178C039126DC54FD
SHA1:	F12F6EAFE04E18A8434ED0015F4BB6C1FB7BBDDE
SHA-256:	CC47C82C0C79555C09A8EF209DC5A3BE8D86BFBE5B666F066927700A617EB928
SHA-512:	D99AF3006DCF951A914A42BECA80B49FBE7181BCEBF3615FFBE7AC0119422208B857AF762FCBFC73B2592F186CAD21390B0214FCD2A0E595A39DCDDCF8CA5797
Malicious:	false
Preview:	LPKSHHRH....................5.OM......h.....................................5.OM......h.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	40719
Entropy (8bit):	4.704149725419468
Encrypted:	false
SSDEEP:	384:7fgStRJ38qtRNG0XPJTsHN+HUxV76uX6ORkfVwagV0ZtoIIHV:7fgStRJ38qtljwJvIS
MD5:	A63F81EDA870B10936E9717BD44AA072
SHA1:	3561E2492C1B2A98BF2B2C3E06BAE481812F0332
SHA-256:	26C4477A6AE036BCFC436DF84CA6298DDFAD723551CAE1C85BCCF518174A7D09
SHA-512:	94BFA03F178A1D6D9950D5B2A2A26D3F95C35E0F66ABB1B2D41C1F849E53E9597F394794FF3892F47F6BBC9257A11DA65C79B3879AA0B60A6223650CF1FE44FE
Malicious:	false
Preview:	Jan 6 17:28:05 galassia kernel: [ 115.561695] blocking signal 19: 5510 -> 3157.Jan 6 17:28:05 galassia kernel: [ 115.735783] blocking signal 9: 5510 -> 661.Jan 6 17:28:05 galassia kernel: [ 115.746841] blocking signal 9: 5510 -> 725.Jan 6 17:28:05 galassia kernel: [ 115.757718] blocking signal 9: 5510 -> 767.Jan 6 17:28:05 galassia kernel: [ 115.767944] blocking signal 9: 5510 -> 769.Jan 6 17:28:05 galassia kernel: [ 115.778689] blocking signal 9: 5510 -> 780.Jan 6 17:28:05 galassia kernel: [ 115.790748] blocking signal 9: 5510 -> 940.Jan 6 17:28:05 galassia kernel: [ 115.802635] blocking signal 9: 5510 -> 1299.Jan 6 17:28:05 galassia kernel: [ 115.814129] blocking signal 9: 5510 -> 1300.Jan 6 17:28:05 galassia kernel: [ 115.827900] blocking signal 9: 5510 -> 1589.Jan 6 17:28:05 galassia kernel: [ 115.839646] blocking signal 9: 5510 -> 2955.Jan 6 17:28:05 galassia kernel: [ 115.851706] blocking signal 9: 5510 -> 2956.Jan 6 17:28:05 galassia kernel: [ 115.86372

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	157133
Entropy (8bit):	5.205481765927778
Encrypted:	false
SSDEEP:	1536:CYfVntRVJn38VqJ8tBfZ76F3BkccGdvUQw7/be1O2QAk6G:EfZ29m
MD5:	CB3F14C8A0F19FD5E30593C746F5C4CC
SHA1:	7F2F351D9CB7C033A1B2648865A8C1D790E6F3DE
SHA-256:	86D4BA7F7124CCE6F1A2FF39913AD5AD041163596B369928138A9C3FB7C86BB6
SHA-512:	B161D423AC2055AE310C8218FF678B9CF93221AD8CBB7369F109DC7E1B6DD0FA4600442C16DBF290AFA033730D7D3C337E32CB21361252911F6822EE702B33D1
Malicious:	false
Preview:	Jan 6 17:28:05 galassia kernel: [ 115.561695] blocking signal 19: 5510 -> 3157.Jan 6 17:28:05 galassia kernel: [ 115.725114] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1..Jan 6 17:28:05 galassia kernel: [ 115.725462] systemd[1]: Stopping Flush Journal to Persistent Storage....Jan 6 17:28:05 galassia kernel: [ 115.735783] blocking signal 9: 5510 -> 661.Jan 6 17:28:05 galassia kernel: [ 115.746841] blocking signal 9: 5510 -> 725.Jan 6 17:28:05 galassia kernel: [ 115.757718] blocking signal 9: 5510 -> 767.Jan 6 17:28:05 galassia kernel: [ 115.767944] blocking signal 9: 5510 -> 769.Jan 6 17:28:05 galassia kernel: [ 115.778689] blocking signal 9: 5510 -> 780.Jan 6 17:28:05 galassia kernel: [ 115.790748] blocking signal 9: 5510 -> 940.Jan 6 17:28:05 galassia kernel: [ 115.802635] blocking signal 9: 5510 -> 1299.Jan 6 17:28:05 galassia kernel: [ 115.814129] blocking signal 9: 5510 -> 1300.Jan 6 17:28:05 galassia kernel: [ 115.827

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/yC6ltl:Rlv+yl56X
MD5:	52E9EDB61168FFE478F1EA59C14A380A
SHA1:	2A1C11BC158084B68A924F01AE51536EBC4616D3
SHA-256:	FD67DFCCB0BA03E3515A433B28F0EE833ABF51B4609464C8ADD6E0A82AE68754
SHA-512:	45E9FBF89AB889F25BD58551A40B0C3573573598F88804E2C15186E1DFA7B63D55AD244965AFD07DC0588D567D81B345AAEF60BA8DE0A8429862F69FB9B5C563
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................g\|g........................................

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.792347747098202
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wev86.elf
File size:	98'444 bytes
MD5:	1a3f54c2e7eed74ef02e2c02fa4beb74
SHA1:	577b929b3f1e2ab3fb686c6efd3e105df8a0d5e1
SHA256:	eb00898107efe0003d3d4dc8da1afba64dbdae6d2d3d263c2e7bcad4822e8781
SHA512:	3be3ce9faddd81224eba961540cbcdf1a634a818aad9435b25190a9903925ef0282536bee091b6945c1dc4dbae4e80b2f86d75c2fe558cb270e5fff6b81c132c
SSDEEP:	1536:aRCj3UJRYvg070QbnSbXayZErG9Ft3m/49b6EDSpgbMhXgw:OCj3U8bsbqCr9b3o4pOTj
TLSH:	63A36CC0FB83D0F5E86705711137EB334B37E439502AEA86D769A936ECA2501DA1B36C
File Content Preview:	.ELF....................d...4....~......4. ...(.....................S7..S7..............X7..X...X...dG..4...........Q.td............................U..S........F...h........[]...$.............U......=.....t..5...................u........t....hT...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	98044
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x11006	0x0	0x6	AX	16
.fini	PROGBITS	0x80590b6	0x110b6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80590e0	0x110e0	0x2673	0x0	0x2	A	32
.ctors	PROGBITS	0x805c758	0x13758	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805c764	0x13764	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805c780	0x13780	0x473c	0x0	0x3	WA	32
.bss	NOBITS	0x8060ec0	0x17ebc	0x48cc	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x17ebc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x13753	0x13753	6.5756	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x13758	0x805c758	0x805c758	0x4764	0x9034	0.3798	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 00:28:10.504106045 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable
Jan 7, 2025 00:29:30.515424013 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable

Start time (UTC):	23:27:58
Start date (UTC):	06/01/2025
Path:	/tmp/wev86.elf
Arguments:	/tmp/wev86.elf
File size:	98444 bytes
MD5 hash:	1a3f54c2e7eed74ef02e2c02fa4beb74

Start time (UTC):	23:27:59
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	23:28:00
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:01
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:02
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:03
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:04
Start date (UTC):	06/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	23:28:07
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:17
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:18
Start date (UTC):	06/01/2025
Path:	/usr/bin/plymouth
Arguments:	plymouth --ping
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Start time (UTC):	23:28:19
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	23:28:21
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	23:28:22
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:23
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:26
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wev86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5803/oom_score_adj

/proc/5806/oom_score_adj

/proc/5808/oom_score_adj

/proc/5810/oom_score_adj

/proc/5812/oom_score_adj

/proc/5814/oom_score_adj

/proc/5817/oom_score_adj

/proc/5861/oom_score_adj

/proc/5890/oom_score_adj

/proc/5893/oom_score_adj

/proc/5895/oom_score_adj

/proc/5897/oom_score_adj

/proc/5899/oom_score_adj

/proc/5901/oom_score_adj

/proc/5904/oom_score_adj

/proc/6065/oom_score_adj

/proc/6224/oom_score_adj

/proc/6239/oom_score_adj

/proc/6425/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1uCSipd

/run/systemd/inhibit/.#2MiZ0bf

/run/systemd/inhibit/.#3dVx9Oa

/run/systemd/inhibit/.#41O16Ba

/run/systemd/inhibit/.#5DiIg5d

/run/systemd/journal/streams/.#9:68789T5Fvyf

Linux Analysis Report
wev86.elf

Start time (UTC):	23:28:27
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	23:28:34
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	23:28:50
Start date (UTC):	06/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	23:28:37
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	23:28:40
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:41
Start date (UTC):	06/01/2025
Path:	/usr/libexec/at-spi-bus-launcher
Arguments:	-
File size:	27008 bytes
MD5 hash:	1563f274acd4e7ba530a55bdc4c95682

Start time (UTC):	23:28:53
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:42
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:43
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	23:28:55
Start date (UTC):	06/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c