Edit tour

Linux Analysis Report
fqkjei686.elf

Overview

General Information

Sample name:	fqkjei686.elf
Analysis ID:	1585057
MD5:	235e7ef841686248d24647ff2b60afbd
SHA1:	bc2e031db47876843d8bd9907e10b6741edb0351
SHA256:	247e55175254ac760a09609f86bed47788907d50b5eac3d5905d6ae3b200f46d
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585057
Start date and time:	2025-01-07 01:28:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fqkjei686.elf
Detection:	MAL
Classification:	mal80.spre.troj.evad.linELF@0/177@561/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: http://wiki.x.org

Runtime Messages

Command:	/tmp/fqkjei686.elf
PID:	5568
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

fqkjei686.elf (PID: 5568, Parent: 5486, MD5: 235e7ef841686248d24647ff2b60afbd) Arguments: /tmp/fqkjei686.elf

fqkjei686.elf New Fork (PID: 5569, Parent: 5568)

fqkjei686.elf New Fork (PID: 5570, Parent: 5569)

gnome-session-binary New Fork (PID: 5571, Parent: 1383)

sh (PID: 5571, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5571, Parent: 1383, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gdm3 New Fork (PID: 5576, Parent: 1289)

Default (PID: 5576, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5595, Parent: 1289)

Default (PID: 5595, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5598, Parent: 1)

dbus-daemon (PID: 5598, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5607, Parent: 1289)

Default (PID: 5607, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5608, Parent: 3147)

fusermount (PID: 5608, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5609, Parent: 1)

dbus-daemon (PID: 5609, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5610, Parent: 1)

rsyslogd (PID: 5610, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5618, Parent: 1)

systemd-logind (PID: 5618, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5677, Parent: 1)

agetty (PID: 5677, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5678, Parent: 1)

gpu-manager (PID: 5678, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5681, Parent: 5678)

sh (PID: 5681, Parent: 5678, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5682, Parent: 5681)

grep (PID: 5682, Parent: 5681, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5683, Parent: 5678)

sh (PID: 5683, Parent: 5678, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5684, Parent: 5683)

grep (PID: 5684, Parent: 5683, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5686, Parent: 1)

generate-config (PID: 5686, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5687, Parent: 5686)

pkill (PID: 5687, Parent: 5686, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5688, Parent: 1)

rsyslogd (PID: 5688, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5692, Parent: 1)

journalctl (PID: 5692, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5693, Parent: 1)

agetty (PID: 5693, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5696, Parent: 1)

systemd-logind (PID: 5696, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5698, Parent: 1)

systemd-journald (PID: 5698, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5756, Parent: 1)

rsyslogd (PID: 5756, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5760, Parent: 1)

dbus-daemon (PID: 5760, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5761, Parent: 1)

gpu-manager (PID: 5761, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5762, Parent: 5761)

sh (PID: 5762, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5763, Parent: 5762)

grep (PID: 5763, Parent: 5762, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5764, Parent: 5761)

sh (PID: 5764, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5765, Parent: 5764)

grep (PID: 5765, Parent: 5764, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5766, Parent: 5761)

sh (PID: 5766, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5767, Parent: 5766)

grep (PID: 5767, Parent: 5766, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5768, Parent: 5761)

sh (PID: 5768, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5769, Parent: 5768)

grep (PID: 5769, Parent: 5768, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5770, Parent: 5761)

sh (PID: 5770, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5771, Parent: 5770)

grep (PID: 5771, Parent: 5770, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5772, Parent: 5761)

sh (PID: 5772, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5773, Parent: 5772)

grep (PID: 5773, Parent: 5772, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5774, Parent: 5761)

sh (PID: 5774, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5775, Parent: 5774)

grep (PID: 5775, Parent: 5774, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5776, Parent: 5761)

sh (PID: 5776, Parent: 5761, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5777, Parent: 5776)

grep (PID: 5777, Parent: 5776, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5780, Parent: 1)

generate-config (PID: 5780, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5781, Parent: 5780)

pkill (PID: 5781, Parent: 5780, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5782, Parent: 1)

journalctl (PID: 5782, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 5784, Parent: 1)

gdm-wait-for-drm (PID: 5784, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5789, Parent: 1)

gdm3 (PID: 5789, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5792, Parent: 5789)

plymouth (PID: 5792, Parent: 5789, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5806, Parent: 5789)

gdm-session-worker (PID: 5806, Parent: 5789, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5812, Parent: 5806)

gdm-wayland-session (PID: 5812, Parent: 5806, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5816, Parent: 5812)

dbus-run-session (PID: 5816, Parent: 5812, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5817, Parent: 5816)

dbus-daemon (PID: 5817, Parent: 5816, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5821, Parent: 5817)

dbus-daemon New Fork (PID: 5822, Parent: 5821)

false (PID: 5822, Parent: 5821, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5824, Parent: 5817)

dbus-daemon New Fork (PID: 5825, Parent: 5824)

false (PID: 5825, Parent: 5824, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5826, Parent: 5817)

dbus-daemon New Fork (PID: 5827, Parent: 5826)

false (PID: 5827, Parent: 5826, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5828, Parent: 5817)

dbus-daemon New Fork (PID: 5829, Parent: 5828)

false (PID: 5829, Parent: 5828, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5830, Parent: 5817)

dbus-daemon New Fork (PID: 5831, Parent: 5830)

false (PID: 5831, Parent: 5830, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5832, Parent: 5817)

dbus-daemon New Fork (PID: 5833, Parent: 5832)

false (PID: 5833, Parent: 5832, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5835, Parent: 5817)

dbus-daemon New Fork (PID: 5836, Parent: 5835)

false (PID: 5836, Parent: 5835, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5818, Parent: 5816)

gnome-session (PID: 5818, Parent: 5816, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5818, Parent: 5816, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5837, Parent: 5818)

session-migration (PID: 5837, Parent: 5818, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5838, Parent: 5818)

sh (PID: 5838, Parent: 5818, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5838, Parent: 5818, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5846, Parent: 5789)

gdm-session-worker (PID: 5846, Parent: 5789, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5851, Parent: 5846)

gdm-x-session (PID: 5851, Parent: 5846, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5853, Parent: 5851)

Xorg (PID: 5853, Parent: 5851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5853, Parent: 5851, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5853, Parent: 5851, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5860, Parent: 5853)

sh (PID: 5860, Parent: 5853, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5861, Parent: 5860)

xkbcomp (PID: 5861, Parent: 5860, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6084, Parent: 5853)

sh (PID: 6084, Parent: 5853, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6086, Parent: 6084)

xkbcomp (PID: 6086, Parent: 6084, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5866, Parent: 5851)

Default (PID: 5866, Parent: 5851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5867, Parent: 5851)

dbus-run-session (PID: 5867, Parent: 5851, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5868, Parent: 5867)

dbus-daemon (PID: 5868, Parent: 5867, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5881, Parent: 5868)

dbus-daemon New Fork (PID: 5882, Parent: 5881)

at-spi-bus-launcher (PID: 5882, Parent: 5881, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5887, Parent: 5882)

dbus-daemon (PID: 5887, Parent: 5882, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6250, Parent: 5887)

dbus-daemon New Fork (PID: 6251, Parent: 6250)

at-spi2-registryd (PID: 6251, Parent: 6250, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5908, Parent: 5868)

dbus-daemon New Fork (PID: 5909, Parent: 5908)

false (PID: 5909, Parent: 5908, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5911, Parent: 5868)

dbus-daemon New Fork (PID: 5912, Parent: 5911)

false (PID: 5912, Parent: 5911, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5913, Parent: 5868)

dbus-daemon New Fork (PID: 5914, Parent: 5913)

false (PID: 5914, Parent: 5913, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5915, Parent: 5868)

dbus-daemon New Fork (PID: 5916, Parent: 5915)

false (PID: 5916, Parent: 5915, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5917, Parent: 5868)

dbus-daemon New Fork (PID: 5918, Parent: 5917)

false (PID: 5918, Parent: 5917, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5919, Parent: 5868)

dbus-daemon New Fork (PID: 5920, Parent: 5919)

false (PID: 5920, Parent: 5919, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5922, Parent: 5868)

dbus-daemon New Fork (PID: 5923, Parent: 5922)

false (PID: 5923, Parent: 5922, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6087, Parent: 5868)

dbus-daemon New Fork (PID: 6088, Parent: 6087)

ibus-portal (PID: 6088, Parent: 6087, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6266, Parent: 5868)

dbus-daemon New Fork (PID: 6267, Parent: 6266)

gjs (PID: 6267, Parent: 6266, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6322, Parent: 5868)

dbus-daemon New Fork (PID: 6323, Parent: 6322)

false (PID: 6323, Parent: 6322, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5869, Parent: 5867)

gnome-session (PID: 5869, Parent: 5867, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5869, Parent: 5867, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5870, Parent: 5869)

gnome-session-check-accelerated (PID: 5870, Parent: 5869, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5888, Parent: 5870)

gnome-session-check-accelerated-gl-helper (PID: 5888, Parent: 5870, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5897, Parent: 5870)

gnome-session-check-accelerated-gles-helper (PID: 5897, Parent: 5870, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5924, Parent: 5869)

session-migration (PID: 5924, Parent: 5869, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5925, Parent: 5869)

sh (PID: 5925, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5925, Parent: 5869, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6016, Parent: 5925)

ibus-daemon (PID: 6016, Parent: 5925, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6081, Parent: 6016)

ibus-memconf (PID: 6081, Parent: 6016, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6082, Parent: 6016)

ibus-daemon New Fork (PID: 6083, Parent: 6082)

ibus-x11 (PID: 6083, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6299, Parent: 6016)

ibus-engine-simple (PID: 6299, Parent: 6016, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6282, Parent: 5869)

sh (PID: 6282, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6282, Parent: 5869, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6284, Parent: 5869)

sh (PID: 6284, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6284, Parent: 5869, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6286, Parent: 5869)

sh (PID: 6286, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6286, Parent: 5869, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6287, Parent: 5869)

sh (PID: 6287, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6287, Parent: 5869, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6288, Parent: 5869)

sh (PID: 6288, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6288, Parent: 5869, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6328, Parent: 6288)

gsd-print-notifications New Fork (PID: 6329, Parent: 6328)

gsd-printer (PID: 6329, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6289, Parent: 5869)

sh (PID: 6289, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6289, Parent: 5869, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6291, Parent: 5869)

sh (PID: 6291, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6291, Parent: 5869, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6292, Parent: 5869)

sh (PID: 6292, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6292, Parent: 5869, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6293, Parent: 5869)

sh (PID: 6293, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6293, Parent: 5869, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6298, Parent: 5869)

sh (PID: 6298, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6298, Parent: 5869, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6300, Parent: 5869)

sh (PID: 6300, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6300, Parent: 5869, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6302, Parent: 5869)

sh (PID: 6302, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6302, Parent: 5869, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6304, Parent: 5869)

sh (PID: 6304, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6304, Parent: 5869, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6307, Parent: 5869)

sh (PID: 6307, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6307, Parent: 5869, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6678, Parent: 5869)

sh (PID: 6678, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6678, Parent: 5869, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6682, Parent: 5869)

sh (PID: 6682, Parent: 5869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6682, Parent: 5869, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5847, Parent: 5789)

Default (PID: 5847, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5848, Parent: 5789)

Default (PID: 5848, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5793, Parent: 1)

accounts-daemon (PID: 5793, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5797, Parent: 5793)

language-validate (PID: 5797, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5798, Parent: 5797)

language-options (PID: 5798, Parent: 5797, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5799, Parent: 5798)

sh (PID: 5799, Parent: 5798, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5800, Parent: 5799)

locale (PID: 5800, Parent: 5799, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5801, Parent: 5799)

grep (PID: 5801, Parent: 5799, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5802, Parent: 1)

polkitd (PID: 5802, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5814, Parent: 1299)

dbus-daemon (PID: 5814, Parent: 1299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5947, Parent: 1)

systemd-localed (PID: 5947, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6095, Parent: 1)

upowerd (PID: 6095, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6135, Parent: 1299)

pulseaudio (PID: 6135, Parent: 1299, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6142, Parent: 1)

geoclue (PID: 6142, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6249, Parent: 1)

rtkit-daemon (PID: 6249, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6259, Parent: 1)

wpa_supplicant (PID: 6259, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6260, Parent: 1)

avahi-daemon (PID: 6260, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6262, Parent: 6260)

systemd New Fork (PID: 6263, Parent: 1)

packagekitd (PID: 6263, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6281, Parent: 6263)

dpkg (PID: 6281, Parent: 6263, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6333, Parent: 1)

systemd-hostnamed (PID: 6333, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6494, Parent: 1)

fprintd (PID: 6494, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

systemd New Fork (PID: 6614, Parent: 1)

colord (PID: 6614, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6680, Parent: 6614)

colord-sane (PID: 6680, Parent: 6614, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6636, Parent: 1)

ModemManager (PID: 6636, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6684, Parent: 2955)

dbus-daemon (PID: 6684, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6685, Parent: 2955)

pulseaudio (PID: 6685, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fqkjei686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
fqkjei686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
fqkjei686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x745d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x74fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
fqkjei686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
fqkjei686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7962:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
fqkjei686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb76a:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x745d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x74fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7962:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5568.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb76a:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 1 entries

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff/fd/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: fingwi.cardiacpure.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.14:34690 -> 178.215.238.112:33966
Source: global traffic	TCP traffic: 192.168.2.14:57264 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 5610)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5688)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5756)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5698)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5789)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5817)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5818)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5887)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5869)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 6016)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru. [malformed]

Source: Xorg.0.log.174.dr, syslog.59.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.174.dr, syslog.59.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.51.dr, syslog.59.dr, syslog.29.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Malicious sample detected (through community Yara rule)

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5598, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5608, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5609, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5610, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5677, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5678, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5405, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5579, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5581, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5618, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5685, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5686, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5688, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 5881, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 6087, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5887)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2991, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5598, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5608, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5609, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5610, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5677, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5678, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5405, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5579, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5581, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5618, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5685, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5686, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 5570)	SIGKILL sent: pid: 5688, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 5881, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 6087, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5887)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5568.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26

Source: classification engine

Classification label: mal80.spre.troj.evad.linELF@0/177@561/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5598)	File: /proc/5598/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5608)	File: /proc/5608/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5609)	File: /proc/5609/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5760)	File: /proc/5760/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5817)	File: /proc/5817/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5868)	File: /proc/5868/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5887)	File: /proc/5887/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6267)	File: /proc/6267/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5925)	File: /proc/5925/mounts
Source: /usr/bin/dbus-daemon (PID: 5814)	File: /proc/5814/mounts
Source: /usr/bin/dbus-daemon (PID: 6684)	File: /proc/6684/mounts

Source: /usr/libexec/gsd-rfkill (PID: 5571)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5618)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5618)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5618)	File: /run/systemd/seats/.#seat0A8EsGY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0dWwqfT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127uBii9S	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#1273OjpvT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c12JnZnU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127gcMuCT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0gVxrsS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127opHIaT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1V2lsXV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1vw1XWS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127tnYbxU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0tR67oS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1LVG1zS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127fPif9R	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1WFaLXT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1RXuMVU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c1cR4DvW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#1278ERpsT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0rVEhsT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127WJfmFV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0DaGdaT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127n5DYoV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat0SznhDU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#1278vg3bT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c2pNdiaU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#1270D1GFT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/seats/.#seat04usPvU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c2ckYMyS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c2aaNGzV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/users/.#127U39SVR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c28gFvVS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c23loGnT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c26XfOLU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c2XNW8KU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/sessions/.#c2gNP8BV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/inhibit/.#1r8BCzS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/inhibit/.#2fFNBkW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/inhibit/.#3lOxtTR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/inhibit/.#4pswHUU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5696)	File: /run/systemd/inhibit/.#5YPu17U	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68721eHk4Q2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68730pIOBG1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68731R2GDS4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68463eH3ev2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:684674yUSz5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68556eEcpp4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:68558tpDQS3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:69755JBJG91	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:69851Z7yqi3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:69954bSCYe3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70009B4AUg5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:700116YJSC4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70070SUjEG4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70072mffcC3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70079wPOII1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70106Ce5NY4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70202KYlPn4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70204oeEe92	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70246vDzyS5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70248MA0i44	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:702915WMZw2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70293ip6ul5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:69086bmZg12	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:69176kppvB1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:691776JVLh5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70663ASKuw4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70695TBBw12	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70739MwRFp5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70864fiTCu3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:70869Ijw4Q1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:71009wkzf24	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:710324ppRP3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:71059LoiSx2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:71134840wi3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	File: /run/systemd/journal/streams/.#9:71135XefgW3	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5838)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5838)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5870)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5870)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5870)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5888)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5897)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5897)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5897)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5925)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6083)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6083)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6284)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6284)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6286)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6286)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6287)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6287)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6289)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6289)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6307)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6307)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5793)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5793)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 5802)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6095)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6095)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6263)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6333)	Directory: <invalid fd (10)>/..
Source: /usr/libexec/colord (PID: 6614)	Directory: /var/lib/colord/.cache
Source: /usr/sbin/ModemManager (PID: 6636)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6636)	Directory: <invalid fd (11)>/..

Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3760/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3761/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3759/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3758/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/247/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/7/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	File opened: /proc/7/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5681)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5683)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5762)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5764)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5766)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5768)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5770)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5772)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5774)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5776)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5860)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 6084)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5799)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5682)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5684)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5763)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5765)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5767)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5769)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5771)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5773)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5775)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5777)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5801)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5687)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5781)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5698)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 5677)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 5693)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5789)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5789)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5793)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5793)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5610)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5610)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 5688)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5756)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5756)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5761)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5853)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fqkjei686.elf (PID: 5569)

File: /tmp/fqkjei686.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5678)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5761)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Truncated file: /var/log/Xorg.pid-5853.log	Jump to behavior

Source: /usr/bin/pkill (PID: 5687)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5781)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5870)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5897)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5925)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6135)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6685)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/fqkjei686.elf (PID: 5570)

Sleeps longer then 60s: 300.0s

Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5610)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5677)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5688)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5693)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5698)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5756)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5761)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5806)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5818)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5846)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5851)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5853)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5882)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6251)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5869)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5870)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5888)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5897)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5925)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6083)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6284)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6286)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6287)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6291)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6293)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6307)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6135)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6260)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6263)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6333)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6494)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6680)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6685)	Queries kernel information via 'uname':

Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.471] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.529] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.807] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.939] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.973] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.269] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.290] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.967] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.175] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.377] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.623] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.997] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.535] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.876] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.459] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.327] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.925] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.140] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.116] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.361] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.942] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.202] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.996] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.572] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.561] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.672] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.534] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.041] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.063] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.246] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.052] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.217] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.739] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.106] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.550] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.706] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.778] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.585] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.003] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.314] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.841] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.442] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.673] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.945] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.920] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.785] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.900] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.953] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): vram: 4194304
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.650] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.186] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) LoadModule: "vmware"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.678] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.904] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.344] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.896] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.480] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.448] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.733] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.198] (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.083] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.909] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.223] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.638] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.607] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.035] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.030] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.782] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.753] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.078] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.604] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.120] (II) LoadModule: "vmware"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.813] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.448] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.634] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.031] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.604] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.700] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.980] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.025] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.403] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.587] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): w.blu: 8
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.488] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.523] (--) vmware(0): w.red: 8
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.575] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.505] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.581] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): mwidt: 1176
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.135] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.948] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.150] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.321] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.723] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): vis: 4
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.615] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.859] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.579] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.667] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.300] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.937] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.511] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.100] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.836] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.540] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.424] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.499] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.436] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.886] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.263] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.511] (--) vmware(0): depth: 24
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.902] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.475] (--) vmware(0): depth: 24
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.517] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.933] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.755] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.324] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.797] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.247] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.367] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.983] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.628] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.122] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.864] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.793] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.619] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.568] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.302] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.401] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.567] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.765] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.512] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.802] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.525] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.621] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.682] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.704] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.615] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.418] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): depth: 24
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.632] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.959] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.406] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.815] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.264] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.268] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.235] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.973] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.430] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.159] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.710] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.249] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.346] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.008] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.494] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.914] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.019] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.592] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.847] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.687] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.729] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.493] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.830] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.095] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.750] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.013] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.333] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.920] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.837] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.587] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.598] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.170] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.378] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.522] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.727] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): DPI set to (96, 96)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.891] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): w.grn: 8
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.556] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.651] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.213] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.383] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.632] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.505] (--) vmware(0): mheig: 885
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.395] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.194] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.388] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.174] (WW) vmware(0): Disabling Render Acceleration.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.554] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.658] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.554] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.117] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.896] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.986] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.355] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.057] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.069] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.891] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.880] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.338] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.885] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.528] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:06 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Silken mouse enabled
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.535] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.950] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.872] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.688] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.717] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.767] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.644] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.759] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.258] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.682] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.809] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.350] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.864] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.252] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.962] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.193] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.560] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.139] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.926] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.308] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.853] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.228] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.956] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.826] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.287] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.089] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.761] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.463] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.198] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.825] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.617] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.908] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.989] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.742] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.099] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.931] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.517] (--) vmware(0): bpp: 32
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.541] (--) vmware(0): vis: 4
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.112] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.646] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.312] (==) vmware(0): Backing store enabled
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (WW) vmware(0): Disabling 3D support.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.853] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.007] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.572] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.236] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.791] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.859] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.279] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.025] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.165] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.454] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.481] (--) vmware(0): bpp: 32
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.465] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.208] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.242] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.804] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.848] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.545] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.693] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.545] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.745] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.384] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.487] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.748] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.187] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.241] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.770] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.019] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.661] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.964] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.391] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.843] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.819] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.914] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.332] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.128] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.735] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.715] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.787] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.870] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 168.110] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.820] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.798] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:02 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.412] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.318] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.155] (EE) vmware(0): Failed to open drm.
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.285] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.002] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.722] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.698] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.296] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.991] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.499] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.832] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.776] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 161.083] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.638] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.580] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.656] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.593] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.166] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.013] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.144] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.258] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.566] (==) vmware(0): Using HW cursor
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (==) vmware(0): RGB weight 888
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.598] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:04 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.711] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:05 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.59.dr	Binary or memory string: Jan 6 18:30:09 galassia /usr/lib/gdm3/gdm-x-session[5853]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.155] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 165.325] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.694] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.047] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.610] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 164.609] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.174.dr	Binary or memory string: [ 163.642] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5793)

Logged in records file read: /var/log/wtmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fqkjei686.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
fqkjei686.elf	28%	Virustotal		Browse
fqkjei686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://wiki.x.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fingwi.cardiacpure.ru	178.215.238.112	true	false		high
fingwi.cardiacpure.ru. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.51.dr, syslog.59.dr, syslog.29.dr	false		high
http://wiki.x.org	Xorg.0.log.174.dr, syslog.59.dr	false	Avira URL Cloud: safe	unknown
http://www.ubuntu.com/support)	Xorg.0.log.174.dr, syslog.59.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.238.112	fingwi.cardiacpure.ru	Germany		10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
178.215.238.112	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse
89.190.156.145	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fingwi.cardiacpure.ru	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Unknown	Browse	178.215.238.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	vevhea4.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	wlw68k.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	ngwa5.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	wev86.elf	Get hash	malicious	Unknown	Browse	178.215.238.112
	gnjqwpc.elf	Get hash	malicious	Unknown	Browse	178.215.238.112

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5822/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5825/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5827/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5829/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5831/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5833/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5836/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5882/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5909/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5912/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5914/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5916/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5918/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5920/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5923/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6088/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6251/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6267/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6323/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:lvn:1
MD5:	14414A3060E4F636EA694A1D46E9CF14
SHA1:	00F8FDD3572CF7E2809C62DE33DD5C4B970C8AC7
SHA-256:	0951BB94865F8FFC6FA7D8BAD7F27177EA66AF8EF70E79A3E54191DA4C4C0419
SHA-512:	8241E82D1597413EB4EE769DAFEA5C60193B7A430981311048EF57437865571C477CDB3D63872D42327E329D4979125E1B555E3364C2A40C47FF03E9252313C9
Malicious:	false
Preview:	6260.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Hde:9e
MD5:	B2C309FA4F4F13B18579D5067EAB37F9
SHA1:	B1CEFD03E5CF67485899DD93E52EE9693D12E37B
SHA-256:	11897EA3ED700C1BAB39E0FF851CB62A1F9EE388BB831B67D32FB9D8F1D5E218
SHA-512:	3B068095AB99B27CD4DBE196A444ACD4D4B07ADE6B146C60913F8C005D898764BAF26E79880A12999193AE1AA11E0368CE579F12E5CBA2230009EDA5E9A2941D
Malicious:	false
Preview:	5789.

/run/systemd/inhibit/.#1r8BCzS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.109910338925392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifFIppTMXSHK72X8/Sf9n:SbFuFyL8OAApfFApLHK7wR9n
MD5:	8547B584149A1B233CF4C7CFBDCDA0B7
SHA1:	2E80CDDA3899F4E109593607F1E2A2CD33C631B2
SHA-256:	A8F184FCADAA598869E273392E4C32241CB54D002B8AC1976C9C6976E3B58CD2
SHA-512:	073BA2BCC6BCC96D725480A017B51D4A771658FFFDAB1500DD3C13C3F9A9C6E55D1D1DCA1E6C0B4EDDA91F1B7F93C624AD06C72C3E8133115D8841F15E9755A0
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6095.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2fFNBkW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.215589092263669
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+4qKLXv0Rsz:qgFqXQXTI1IlJqKjcRsz
MD5:	93B69350244D89D9F6AE1D7E08E60C72
SHA1:	36283821430B76F74431A61EDA71FCE5D1CFE0BF
SHA-256:	628BB34604510AD247B429A3D3712C3CB81173B02715BAFA30754CF72A730C04
SHA-512:	B5FBEC37AD671E5D6C90C378D917C958316BF0A529355FD61F3B1390CA353877FEDAD74C2F6115028958C84B1369B95F36CCC53AAD5E57456CB97F83D37B6E21
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6293.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3lOxtTR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++XvytsiXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+4qKLXv0RT
MD5:	8359D1A75A4573487224F7F75F11E257
SHA1:	D806ED2FCCDB6DC2F340E6650EC8684D012CCF7E
SHA-256:	626BDE795C15989680288B2F7458C1E73E0D17F177CC501229E230B39D7BB977
SHA-512:	8A10EF34B5299E3A97E708F3C59D12A633016FCF2A663A4E6E60895C0183241B878A9CB853118E3A4EF3CC428AD2283834CD4D97AA47A9298A6815DB84EEB48B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6293.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4pswHUU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.165199761184817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++h53iXulpv5RX8/SflY:SbFuFyL8OAAx+WFlpLRS
MD5:	B19C37F0D8DC3EEDF08DBCF05539FBE9
SHA1:	8249759AAD4564746208252BCDA25EBA221124AA
SHA-256:	E9007C32B48D64036459883FB50461C0F91D689EE935429FB677EF6F6FDADC34
SHA-512:	4123B4174F6BA3103FFE40A86190F3711D212D0CC34D1218C1926747C98AB710F326DB2723033561EB4FD747B4EE8806ED3E6B76CB49EF644FA1BB1FBE0A3155
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6307.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/inhibit/.#5YPu17U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.957400514528132
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifyYmDkBoDWicRF2Tg+tX8/Sf5:SbFuFyL8OAApfLmDjDJcjKR5
MD5:	3B26A2F8235B30A0390A2C3E25BFB683
SHA1:	35A7627772B61785A0CD3BCB9CAD2AD7E8CC4254
SHA-256:	04731504DA87349129C8D9C9EA6EC571BAAB8A8E86B30B3915B97BCBA97C81E8
SHA-512:	76AF63AE546433243015F66CDE4863D8865B4E69AD28B50B21E45092331E08DD7B7002A07DB1C8ABFF2A6A5954A4E212492FE36C4FF8CC2D5E92967B287AFABA
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6636.WHO=ModemManager.WHY=ModemManager needs to reset devices.FIFO=/run/systemd/inhibit/5.ref.

/run/systemd/journal/streams/.#9:68463eH3ev2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.423726915018755
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6eGsded6WVnRsjs2ALl:SbFuFyLVIg1BAf+M6ZF6zjNALyAZD
MD5:	89F666AA4668A0E58C220943A0522C20
SHA1:	349C9D9A1CEB67069A18AC31257E915527111DFA
SHA-256:	C002B5069BA00C549945E901DDF837D1329C366EFF3562D2F3650E03E2712CFB
SHA-512:	C94E76EF994AF76863B46D62E040D5B45EC23F45D75A1A6455B86AAFFD3808FA85B9C27CA38C502FEC3F163D3F23E8973998CA0F868C97B9418986FBBC5CE52D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f458c0c2a564f50b8d3cd5e33071c32.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:684674yUSz5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.516454649052514
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr/xQM9mHCs2rqjs77:SbFuFyLVIg1BG+f+MVQMMCsMqji4s
MD5:	A3765F4BA98162EE21D0B05A9D6853CC
SHA1:	BF8A166F734BE3A47187EDFE6743924EA0341874
SHA-256:	FFAB85C9AE04144D992E0BCABB655181E52019632EAEA6674AD047558EC2DF26
SHA-512:	C293B77FA19B36CD7BA7977DEAE4069A9D6517D8E0301AABE1E8D06566979F9FE59B23C974B65A53708611467DD0C6232168BCD7B7684352055C76C03B98C83D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a00b4a7d21b24fce85c10b8de53c5a97.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68556eEcpp4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.49000792576662
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm52hUVWSDi78QBuxsjsd:SbFuFyLVIg1BAf+MUUMQBQ5jNdQIeXD
MD5:	A7BA73D4999C5D651E9329D1EC25B880
SHA1:	D34FA27C0921D3BC7F4100CC4FC829F93CC66B8B
SHA-256:	912E3C3707B2216AE5E3CB18E2AB3F4FF1D290C63566277D80937A4128229970
SHA-512:	7082F45BE58CE1D9A3CB67DEB03F6300A3D0576C5418EF143EBFBC3C66549E32383D9949671028B77309DACC99AE867A108B40BC6AA430C20D913976AB6B4D81
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=382968b10713476ab9e0c2c0448a05cb.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:68558tpDQS3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403699573534632
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr1UdiHR0xQRNmIej+:SbFuFyLVIg1BG+f+MXHR0xhJjLkGq
MD5:	2CADC347830B2A400FEAEB4C2EF73A64
SHA1:	B2C301B3907634D7D5C2AB0359C9CF491F95E525
SHA-256:	F0FEEF29B86EC488E0A21F5B4277E7E30758E0BEE9F7B282B67ECF5EF333BB65
SHA-512:	978DCF2986FF023A6A85818F769332E2B21D2E2D5FD1ABDB22AE49FC1C80EEBE27338DF0520E4C7DB12248073323A9274BC0BF503D02E2661DDAB852EE4795F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=adf189baff3b4effb9e2542886e6e7a8.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:68721eHk4Q2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5423489876660454
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4ALX8KHFE2Fgtlsjq:SbFuFyLVIg1BG+f+M4/Ke2mt2ji4s
MD5:	A66B8FA8244B2382D47FCA02C3996C2F
SHA1:	D7DF3FF578FB89CD9038A027B738CBE1CBE9FDF3
SHA-256:	DCD3D68C6F8775E65661D9583A155A19008FDD681D055683CED7A5C8C6759E0B
SHA-512:	7AC77D2B428F13E9D732F0A03BED49D703F0026D0678BD056DF9323701619369276A11F4701C41AF378246FE075E650426BA0622B758B81C1B2EE9E3A785AEBF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e84b258ff9d4fb4b226ab3754e4c94b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:68730pIOBG1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.467346347719688
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MueVS/oF2jZcHcljX+:qgFq6g10+f+MeoFYmAu
MD5:	D28B2096D9AC0B030FE5557FC1CC68AD
SHA1:	5B5CAC144EF041196605F7F999C09E80C3F8355F
SHA-256:	4632F6ED9CE9D1F736C0C17FC72265A1E93A5031A235BEC29E3F77F9F94003FE
SHA-512:	6411E79C5A7CB2B2C4F2053D814CB114E65FD3933E4F2B5174F3E66C7BA04C8AD7E8538FD1410D0F8385B59CE242284618568ECDC8D9B314BEC605A39DE0F3E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d89e34a0214245969ecfe034543bdbbe.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:68731R2GDS4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.424096648039856
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7bREWW/hjD1sjs1Ha:SbFuFyLVIg1BG+f+MqpjCjosQu
MD5:	B84EDA70F8345055C8AB1744E47A4B61
SHA1:	ECF793573D9BA74906B30554F04F9B786B102670
SHA-256:	A638B5CDC4F81E1AC9EB6B5F19554B67589734664475DB57A8E0AF92E354CA35
SHA-512:	162403472529B76AA520960EC6CA8BB5B45E8B637DCAFC9234EDB60668E3D8A9E5E845432564944D4E0833D597260675EB75A239983B7CAD7CB134C790B8CCF5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=11f9be7187364863acd5fd194e34aef0.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:69086bmZg12

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.355754832520359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsIgGDeH98QQErqZ:SbFuFyLVK6g7/+BG+f+MsIO6ljN3r
MD5:	DD1EC556FB284C323313ED59D366649C
SHA1:	2CC8FB53EC8394E28E519DB4691E006F21DE64D3
SHA-256:	72AFA5E70B5A026FA68C854EAFCBA7D86A95353A0B94EBB0B41955B636531E3C
SHA-512:	7CFA7C35ECC567C3C1CF25418A51B0F95305BA3D35B7761E5F6D2B31F375AD817357B511C4578628290EDBF779BA5C2589920B6C5D241F9CB5FEDDDC87C04504
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f6c64cc1b9bf4dafba155ce4e96078a6.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:69176kppvB1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.431169000005052
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+BAxBSjFmzXvn:qgFqo6g7/+0+f+M+BAIQXvn
MD5:	60C773829EA1AAF8BB9F7FD462C12B35
SHA1:	FF9F46FC10C80544896BCD4A6137CA2D5C2E9CFF
SHA-256:	CE3972AC00958EB16F4E79CB166783D176847C6FA001F422B078CF5054E836B3
SHA-512:	25363446C02330C2D3449047C373EBF42A15DBBAC9A31582C6C6DF543A5AF0237F44D85B2AF75B97A60177A4B98C78B472AAD11B524D64275CBC21E6BEB08036
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=99a54480f7a644d3b51b117dc707711e.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:691776JVLh5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.375038044880046
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+QbSzljFmzXvn:qgFqdg7/+0+f+MQbQXvn
MD5:	88F20E17D049B371A9DB3876EBD98745
SHA1:	D6C7C42A1C75533356C58B6310944340A9ABD779
SHA-256:	0CC82B1A8AE0CF5BF6199413B7E9199C4CF1696B494F6455272F66F913393895
SHA-512:	C98EBB3673E135EC6BFE36CBF012A40FBE0629CBC9FD408C9517AC0DAE301DADD15F9909F90BA5B296D8ED0CE6E68AAF41E53A02EC1342B7D316D71D9238E451
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41eaf9e0aedf4f4c9c6405c554697e20.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:69755JBJG91

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.422541532104555
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp+JRF3cWSQE+sjs2BZd:SbFuFyLVIg1BAf+MEJRF3S7jNTZD
MD5:	564EAEE25DD5835390732A515BE81F0C
SHA1:	881F1AA46460B119B75836D543E5FD2EFC7E7338
SHA-256:	54345588EF3C344CDEF2E6DD848B1ACB4066D07DA962C5B37C60DAFCD908CD1C
SHA-512:	6041FC6E04480D51ACE0F59498665EB25417769091B764247CA155660F517B5FD536A4C30670A2391B97CBF08358B11FAE1B5D369200D0533C663AB00B8385DF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3256d5f247e45508937cba5c865c62c.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:69851Z7yqi3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.428642803970042
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MIDEcYYTjLTTIWTIL:qgFq6g10+f+MmxEWEL
MD5:	AD39C267E1E54BA818F2F114DD64738A
SHA1:	F51FE6D1E293D674C635BAE06B47F36FB5B38E04
SHA-256:	B0CC79A5EEF925C399ADEBB52239CC5A280C02B07450BAF4E6FD16753193069C
SHA-512:	F2360388D653239947FC5D1FB3A7E7290235D5C21F5E21ED31685EF086C229157CA885103B502557E6D9188CABC8AFE3C44A13758066C60E494764D617834AB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b812f9e243e474bb789c4a2abe54c1a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:69954bSCYe3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.341876989768048
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8dAFWUTyVGfGBoRxN:SbFuFyLVIg1BG+f+M8wfyAfFqjbVC
MD5:	407DC48377162341E432A23EDE2DCB02
SHA1:	9FD5DC489DFE5CB0234FB2E457AFEFACA98BBDC3
SHA-256:	BA9933D4E448DF0798805D5CF6D3648C695B241F001CE026741D43FD83B54EBD
SHA-512:	8A80CFB2AF70DB62674CFD54E6471890990D2864885C02D7EA781E77EC936DECE4EDADC812FD260FEFB2EA52CA2E8A20CF8997792F3CA91BBA66B7D5E19C56C8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=61ae0d3c341641428dde99eec8a8ac33.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:70009B4AUg5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.446212249774373
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M0wjDeLZDtHuhTjNq:qgFqo6g7/+0+f+M0wjqptOFq
MD5:	7F51E918EBCE2DE0791927F111D3E598
SHA1:	D89ECC4C643EE9E28E24E68CF1BCE2C13C7CCD00
SHA-256:	05ADBDB8C7F236D3ABA0AEEBF09C879D4DF67134E4BAC144261B4956D9BA097B
SHA-512:	7874C22D79E9A17CBE1F475F8B25DFFFFE8494907A723428BEF3A195D7B1F77182EAC19BE8A6FDDD0D607B15218A39440DFC0077B01E77C6A07A6692039658D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=981ac6529a4240f898d279dfc38dbb0b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:700116YJSC4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.420589365557195
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm//3PV3aMvWRO0hs:SbFuFyLVI6g7/+BG+f+MVtvWRJhTjNq
MD5:	48A5ED25DCA0DFF523571D96F9C487AB
SHA1:	4093D2081AE4E95F9DD831553F0DB49894B46195
SHA-256:	DF23B6F6DA1C429FEF2E8C76F3080D546ABE9E24308FADA6C7B9EC8E2720065F
SHA-512:	3722B93A5F73BF193DFB1E912DF30EEECEACEFBE8E518C3DD8529C2D367E43960C9CC6B8AC57C4774130109890238E4772C48FFD11F21CEC67A5E35AF1B31CDF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a37af60054945e185af5829f88c3412.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:70070SUjEG4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.474100292292192
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsVm1ZRjc2Q3TjFQMzKaBu:qgFqo6g7/+0+f+MsVmWHNTmh
MD5:	7F7B2837D9DF0439FB055AAB181F9251
SHA1:	699F3FD8A7C2553E8521431AB8A5654F463BCB09
SHA-256:	88B3ACC0A87DCC9DC797254942DD46D54534F92CA034606C0D75010E5344AB09
SHA-512:	01B78CCB8447F3C61AF8CE11B3ACFC017C8DC2001F89C537A883B507BD7F01406A3CFAF3E4CE84220B138DA380632288E347D707389F186D300B387FADC000E0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fed9709a7436403780a81099b5dda56a.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:70072mffcC3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5451594756312526
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4UAXF0Yg2jFQMzKaBu:qgFqdg7/+0+f+MFI0YNTmh
MD5:	5557E4A888B5FAC8171C80767C987DC4
SHA1:	AF31EB5C3AA4B0CB394E4FB46AE151FA1ED9CCAB
SHA-256:	DD2D9E0DD9E66DD7F39F59574FD4473B1A33FB4BDD85532600A00CCF44638C01
SHA-512:	AC30F50FE08678EC150E50DE4E19120444B6C46DF99AA2603CAF6B7BF1072D97E0EE978C42D3F8484A562B7387DD9145F1AEAF20BDBFFAF16E01D34BBC5B617E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=741182e9e41249c7b68f10b051f394db.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:70079wPOII1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.315669040516276
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvBKYERyfRWkTZU2rm:SbFuFyLVIg1BG+f+Mpbdwk9Ujoa
MD5:	5CA9946AEB8EE795C9357528D20FAC6D
SHA1:	0C931B66356E75DED1C37FE2490FE6677A566EF3
SHA-256:	9966A904092A22E1DAE417256BB5A24FB6649C24528A3FF6A58A5AB07275E303
SHA-512:	40716D1F14FC19C34F49DE29AC09C74D2FD78DFD8A8FD4B9DD2BE621C986760A0AD1DA144AE2F6B47836BC3E32725705AAC1C5D96E3C56ED7970A186F8507D86
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=edd5ab0e782a4da88a0e38471564415b.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:70106Ce5NY4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.373580211193585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5YGYzDhBDViWW/E:SbFuFyLVK6g7/+BG+f+MG1TVyN2jN3r
MD5:	053A07B6B8FC389D93AF7847C9BCE100
SHA1:	4B87F22C5925989CE63FE28887288D3E736C0B4E
SHA-256:	3C616596BB003ECF4D155AC5B1A57F0F91340AD07AB5C65C4B12D64A2D02929A
SHA-512:	E77504A7470642533C34FDC5632704B2C965094EAEF9C16ED200C0DAB638880B9EF2A1A8FF726F0740AA1520DC48086A7412AFEA8D3E6EA527F9EDE85E3306A3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3626d267c61e4a4f95df0dbecad33820.IDENTIFIER=gnome-session.

/run/systemd/journal/streams/.#9:70202KYlPn4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.426895235143684
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuuGddg7ZjFmzXvn:qgFqo6g7/+0+f+M9++rQXvn
MD5:	ACFD6B2C9BE2D74FFB33AE67CAD82D19
SHA1:	533B53650D30F663682FEC399E06D9F14E84AE3D
SHA-256:	B1790DAFE396F1A7CEDDC86B11FC9B1698911ED4B5725459DCF418AA2A6CE9EE
SHA-512:	DB66172C86E37281605F17CDBF2AEF5D2A29853A4C81BF7987EF48AF36D9BC7128E9C88C23B8C6DBB358436DF25CC8527FFA6C5518E8C9E01ADC0363CC1CEBD2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4cc6025515d416dbaf9aa95b9835dca.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:70204oeEe92

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.407185342594401
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8KFhF2jFmzXvn:qgFqdg7/+0+f+M8KVEQXvn
MD5:	5C501E2D3B1E9FE5831ECF24385D20D0
SHA1:	4F38D21EC1770C90A66C346A1F908398085152BB
SHA-256:	CB97208C670F47318ACAD0665B3E45A2D069EA3C530118F5D45041E4CDF4688B
SHA-512:	6B87BDD27491C125E8287EA3EC939DBC577FFE3FBCDBD4104A800D017BB9DA067DDD0A473CB3977E34F84A911021CB58BC3723CFD77187851B63C5AEBF48877E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=684d9abf0b9d487997e78aefd2d436b3.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:70246vDzyS5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.374335262948715
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsDsaR5yLVAbx0jNq:qgFqo6g7/+0+f+MsIaaxSx2q
MD5:	0CB279253CE5E7FFC32E61F8B20E6982
SHA1:	3CBE92AA5824014108E2488B620219047E5B30ED
SHA-256:	6CB263C1835D78DCAB4F99CAC2AA8BBF5E6B3D4EC1F9EF037030560E73309AF3
SHA-512:	47A166DD5B57DF17DC0E2900B353972C6B294BAE67BF723372E9CCA525133D290AC2CDEB596B82D88C91BA64F7E5B04341180FDDADF0D1A5EE2608958421B961
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff0c1f467f01411da3673714ff415042.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:70248MA0i44

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.429190986087277
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6PbXVvmABTTTTAs:SbFuFyLVI6g7/+BG+f+M6DXMq8jNq
MD5:	AC078C936BB0050E68E5AA8BC4C46D1D
SHA1:	08AC916BF8D692FE194DB4DE5026DB8768F98FDE
SHA-256:	DAD52FCA0E2AE1718216560A47D526CF963DE1887B4C40A488852FA91FA194DA
SHA-512:	69EB4F344923DB616B593567CE8919CD6F8FB0E6469AD81CD9D24129EFF8362ED3FDA58F8C89E6D1EA14CA03F42F87218FA3FBB2425440FCC5C828550C70BF04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0895fb2f4b3248858670c4264d8666ec.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:702915WMZw2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.463340460329099
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoL/HjFQMzKYA9:qgFqo6g7/+0+f+MozBTmt9
MD5:	ACC045C362D1FBF4C4029EFE1EAD81EE
SHA1:	C460CC7B0504955156CFA69BADD9176820FF3282
SHA-256:	3066A2B7A91EE0F4B16CA0DE25B70BB3680E39AABAEDC24201722D2CC471E39D
SHA-512:	CFD142B4F77839A8FF3808B3C5AC1A9ED615D336ADF357A2A16AADF82EEA79CE77C7C487FDF7B7BB58E8610D8746431DAB3E43678C183AD91DDCD6402EB76738
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b84b8d5add71493bbdd39c9886d7e31e.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:70293ip6ul5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.492865399477649
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5ZvI+0kBvsMqjs5:SbFuFyLVI6g7/+BG+f+MQjFQMzKYA9
MD5:	EA19F3B74603CC36E849E9D70B4D2F52
SHA1:	9342056DDC3DD0B47076F0DDBEFB1DC371BD496E
SHA-256:	36DE8E96DC888BA3EA18611BD22DD2413589DDF4F065ACFA1BFD58415BD946B2
SHA-512:	985F79A3491E52AF4FD6D7A45A8445B5521B68D5DCE84138E9DAA65B9964E4EF77C10935E6B824864DC4F8BF7DCF5E0B9CA2C7C204ED4156F294231B1DD864EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3255ff3b3df144038f16fca890e0c64d.IDENTIFIER=/usr/lib/gdm3/gdm-x-session.

/run/systemd/journal/streams/.#9:70663ASKuw4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.429627240192522
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M88E2uHv722jZcH5CHq:qgFq6g10+f+M88k/mmq
MD5:	2B23070FDE8C7C56B80149FC70B69352
SHA1:	F68964E303660238A7200279FD93EF298ED4C604
SHA-256:	1FDB74ABB4714C896A764B2028FADF5524294A6521C15CA1B4DCEFE8926B3261
SHA-512:	A0A4AB2BC843D921961A644F9FEF6667B020D8FD69C89DFDC7176CD9FABF481ACB69AE01C5CAFC32FFE46509708698C161CEA06AEC001F49FBBEB425925205AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=64d4ea0d83044a9b98724ab39b35f00a.IDENTIFIER=systemd-localed.UNIT=systemd-localed.service.

/run/systemd/journal/streams/.#9:70695TBBw12

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.414543316364341
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9cAQQHd5EQAHXfdFX:SbFuFyLVIg1BG+f+Mi5KEVlqjfGt
MD5:	1F059F3844266E3FBA74BE6EE471A3EA
SHA1:	A5F51923587D79BDA402BD897D462596D23974CC
SHA-256:	0360DBB7992DD0031921819CD03239B26D10A896A0F9246126EFCFCF9AAA2BA8
SHA-512:	628CADB8B9BBE9038D6761B300E78CE35E0BF5FA421C04FD0F8C284986351AFBAC3D4042C2BE394454F737118FC09AEDB5AF20EAED4F3E7C113B135B9AD2F16A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7157edb32eb6427f9a5eb2df08c7aef8.IDENTIFIER=upowerd.UNIT=upower.service.

/run/systemd/journal/streams/.#9:70739MwRFp5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.331450067364811
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7m6l1GdfF5zjshQJT:SbFuFyLVIg1BG+f+MqtjtWL0
MD5:	24B674D5D69494FBC6F2749A61760867
SHA1:	A74492B094D845ED81A3126C82E9F9FC985D0F95
SHA-256:	90E0B4BEE93C3ADA8B5D9E6D01FBBF4748201F5699FA5B9701B976D1DB836AC1
SHA-512:	DFABB24637319ACCD0DAA59441B1A234D15678159152D350B6CA74E46D66018CD0EC3BDABC625EA62D8813737928A9661E3B6A9237F123C1CE73D4A3548C541E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d5a650ee5c84a449ed6330a05794f26.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:70864fiTCu3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.40376335490893
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M/C4/gWqjNALQru+u:qgFq6g10+f+Mq4/gWwWr
MD5:	F0B95C477020C1E394634A54868531B2
SHA1:	C1812BF2FD25C29C608EDDFB800BA98C8ADE2B1E
SHA-256:	D76E3496908971B490715D5314A5D64DA7D43CF09140C602090BC927F3390BEE
SHA-512:	2DB2E979D63BF6B672E9B4FBA2FE7EEEED19D84320CEC13F5B8516862F0A32ACD5129A2ED81E1976CAAAFE52DAB69BDAFF896FCF24F1CC9CE266D2DF73FB7325
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ed568e9e4e44e1f92ad6acf79588155.IDENTIFIER=geoclue.UNIT=geoclue.service.

/run/systemd/journal/streams/.#9:70869Ijw4Q1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.434102402656797
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GsHaPxfvAuqjsjOA:SbFuFyLVIg1BG+f+M8pQvATjNE
MD5:	1F24364206D53330A8421D2F973859F2
SHA1:	CC56B377D04DD391DFE8B8E8D9958C9227219B16
SHA-256:	7298F473939491D79FC4056CB2E6B091007AF254A2322C2DA749D54565E1C345
SHA-512:	1B9ECB2F14CE542531122C667C48DBA9FB2AE5588A27F641EC451BEE5BE90C5ABD6B7DE07F9E89E8D203FA6EE4A853F7C950AAE1F89844FCE4264C200ABCA0E9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c9810c83c5b4d7e98753b73c34310bd.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:71009wkzf24

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4101311363418505
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4HGB6CGxFjdcjemEg:qgFq6g10+f+M4mHGxjOemEg
MD5:	9932CEAACDF2D266C12A05B3DED45018
SHA1:	70A7C1AAFA5096F6FC54C3263272501FEB7571F2
SHA-256:	7FDE08BCA889D6EB60199A914D8D308543E6B8C017DBBA68142D61015953D0CF
SHA-512:	EED30EEE15476B01505AC626C527747B059B586CB6A7FEBA57C2C5703C668FE2A046FDA9B7BA3739996F6668FD020FED01580A69499A2840CFF4BDD73C6D0B04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2bc253d7ac2d42c39b67e1db42a10801.IDENTIFIER=wpa_supplicant.UNIT=wpa_supplicant.service.

/run/systemd/journal/streams/.#9:710324ppRP3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.361059895835151
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9fiFvpvA+sjswIN8G:SbFuFyLVIg1BG+f+MYDATjLIiAvAW
MD5:	6018FB84EE1F4646822D047040458DE2
SHA1:	95CEB780AB733AAF39DF5045EF15579DBDF18BBC
SHA-256:	5FBB9526EB8BEF32A3AFF685CF2250B210C8722AACC1E62BAB003E852524EA74
SHA-512:	3BAD4175C0EA8BC4075B9DB619C1D69FDDF65FEFD513DB248A6A00B6C220CB5A5746E31331AB025A90475EBBCE8F734A0F9513DEEA6CBE61E9A8ECB1CDAC0D61
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7aee3c7ebcb54e649abbbba7ab97f923.IDENTIFIER=avahi-daemon.UNIT=avahi-daemon.service.

/run/systemd/journal/streams/.#9:71059LoiSx2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.408543892513838
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsG2EBWAs1s6TBcsjS:SbFuFyLVIg1BG+f+MszEfojuTt
MD5:	07C7D6969D353681404064FA13CF0506
SHA1:	40E84B49615B19E613F61151D1F27679C3EB7CE2
SHA-256:	F3BB7654201C3D608B2ABB089439CD004AD3A6D2BBC62BE5E8AEBB421CF24993
SHA-512:	BA2801656BE218A8B133F728201A6AA718623D5D061B77FECAF9CFCD6F9F363683C42E4615A2F3DB275BECE588B4534DE6B763D45CCA73B11D4959A0E91A1325
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc9bad5f4d0e4984a3981582bc6b4b03.IDENTIFIER=packagekitd.UNIT=packagekit.service.

/run/systemd/journal/streams/.#9:71134840wi3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.4271297448134055
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M27RPyS3TjFmShmWc0vn:qgFqo6g7/+0+f+MM9kWc0vn
MD5:	7D42581D477BDDE2625EA8E3AFDBEA4D
SHA1:	C04A44167EF3A89029AFC98E2E53B16BB0528E12
SHA-256:	E2F6CD9661A00EC15C7077B41761758A5DA5B65B4390EB01A803A9764B80BAC4
SHA-512:	2BD3631B6AEC9A229CFBCF6280B3C03B04A3901E47E52CFE2C2E794A6FFF1C66EC13260F8B14AA7A8F811237FB450D9A53BCA9B213AFA0C04F6D65160D65E8D8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f37be51aff949dabcda5383b75d76eb.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:71135XefgW3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.41614686753109
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MgOAMvr3iJF2jFmShmWc0vn:qgFqdg7/+0+f+MgOAMvr3i29kWc0vn
MD5:	85F01124F1E629062101BA9245588AFC
SHA1:	28FCA86BB917D1AF6E5EA59C2FC9E16A68EAC268
SHA-256:	3D558CE0A1E316CA3E6046E884A85837FD1477CD4AD0B94F6D7DBBB05527B68D
SHA-512:	FB78191C72823AD2C5100CECB3A933E56C2CCE97D478CF835CD024663347A1C474F00062D3DF2A86D7871933D1D2EAD618243E5404900EAA0EACE45B1A400E27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=51472be2f26546279c47999c96625a62.IDENTIFIER=org.gnome.SettingsDaemon.Sharing.desktop.

/run/systemd/journal/streams/.#9:71136KZHiW4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.416796029138486
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8RdcAgrqjFmShmVxfvn:qgFqo6g7/+0+f+M8Hu49kVxfvn
MD5:	E60C968F1F22F356A3FE5E26A12D5C81
SHA1:	616E981222093A148968D01EEAB5D6F7B5CC91F0
SHA-256:	8BB9F5FD0CA496504093589C88A6F259B83130E153B93E8B95F51BC4F8236A76
SHA-512:	530A3F53EA2A390280DA1B44BAF7E69B7D0B251FE1BE6090D64774C301A0BA2C9757BD651AF824933E5D60825994A3CAED19294F869D23010AAE255C7EB6D61E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c7d2d5f29294efcb2282ae3aac935f7.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:71137F8sk41

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.426488368855259
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MadPYWLWkjFmShmVxfvn:qgFqdg7/+0+f+MWxWu9kVxfvn
MD5:	3F1A12A442A0B69D4960F6F2A9EFE6F6
SHA1:	AE567931E30425092C67A8090BA0D0AA4DC1B918
SHA-256:	0EA1217B17EE7C4AB8D2E5C7D3B2DE9FE890FE0A16EFEDAAD5F8F85C8D33B788
SHA-512:	BB26EF8904E7CF7DB06427794CC5F2EBA9C2893EE5E31A9465F15CC4CE34ED64037337643F4F9C79AD0CF666D315B19A42527A988580CD8292158CC3E5212A97
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a196dac71264c3e80a48f6cff508f32.IDENTIFIER=org.gnome.SettingsDaemon.Wacom.desktop.

/run/systemd/journal/streams/.#9:71162KrPT11

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.468049750108969
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8egqc1StVQqjFmShmDxfvn:qgFqo6g7/+0+f+M8egqPnQ49kDBvn
MD5:	6DB88C7F71A96FBE942CC8920212DB81
SHA1:	9607E67C4B9A879AB4A122EB0288A23DCCE0C0F2
SHA-256:	EE561D7A859D7BCC1A6C0BB8FE756B79559C77E487747F0E5146076ECFFBB143
SHA-512:	5F7C9AF00C8ABE9AF4FB04A003DC9B96F1FD6CB1868AB70082E62E964BFE0F2C5B3B92E8F6E93D2718C2349EBA20B2699EB9ABDE4FE929ED1B8EEECA31FFA3D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6135fa72c51c40c59cb904797668f047.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:71164cpe7H1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.411306815503296
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+P2L6cBqjFmShmDxfvn:qgFqdg7/+0+f+M8sB49kDBvn
MD5:	A6A27050065C2E6FA3265244F0D8FF4C
SHA1:	CB2B24978F969C7E4B7D8B20EEE3E621BFE72924
SHA-256:	1F955AB56B6E7C3AC5072BA5554CA8FC6E4ED316C05B0BF5DEC902DDB7C201C5
SHA-512:	65953E15BD3F879A76B92CCA6EB80A3603329979E9843F7F99E509A2EC253AFAF595CAF19B0ADA8D059F4B6FC9396E5006B15E91096EC78AF638F4B9488A6C00
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=469c67824ce649c682a0ae0c3162248f.IDENTIFIER=org.gnome.SettingsDaemon.Color.desktop.

/run/systemd/journal/streams/.#9:71187EnEBv2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.4297456027129805
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyB3pF2jFmShmxBrvn:qgFqo6g7/+0+f+MAp29kxBvn
MD5:	820CC413F7D3A5BDE16690005973CB0B
SHA1:	0274175178C06CEE6402927B7EE02B60F1F93ACC
SHA-256:	FDE906010E84E787EE9DDBB3CE6653F0ABE656BC4A3CC1C15B3A3A8BEDC85DB8
SHA-512:	B1055F19B054657A22461D034A34738F7902CBB45E69B90C74F0D0FD016A5EEC778C96A99309BED324A92DC7DAD7E7F1F9910FCEA2C4F95D78EA4F19512370A3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9835dd320d4f430f98be7bd6cfbdf2de.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:71189rfX164

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.423117880520061
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MukjFmShmxBrvn:qgFqdg7/+0+f+Mn9kxBvn
MD5:	015C3C8B01D472ADA3F299D52ED3DB7E
SHA1:	34B1D0B8F3455899B325D961A3D3E386500415D0
SHA-256:	7BE277B513BDF1E806F6A6CD1701021A60B74E694FE5501815DEE20AB0730E4E
SHA-512:	5EFD8D71D1BBC4BB36BE2BC58570243035D2F10592A16039454A5B37905814294CCE11F058778ECC3055F09EEDD5B927379C420346562BC872CC1BDB6D9D15E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dde754002aee4249bd1aff6134a48c38.IDENTIFIER=org.gnome.SettingsDaemon.Keyboard.desktop.

/run/systemd/journal/streams/.#9:71211IjXuO1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4485131196039385
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MWc2EqwqjFmShm5PKJ0vn:qgFqo6g7/+0+f+MJZq79kYJ0vn
MD5:	B71CBF0299FFE20231F50D0D918E058B
SHA1:	65FF8C2EBB1FEA7C73E90B45B9E1A425C4077ABE
SHA-256:	8A36070A80790C90CC64DF77FB2556B2AC3B30022E08CD2B20844015C0549CD1
SHA-512:	FB3B881210C84462C6D2414F368F7CF823B5E232F4181EB72B68CD0965D961CD259B4D1F267B2785877E85C385B53E3CCE95B0CC1B6563B56320D41F9C2A49F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb3c7c9865aa452b9d4d261387d3322a.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:71213ysmqR5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.401557117994744
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MfnEbrWvRFTjFmShm5PKJ0vn:qgFqdg7/+0+f+MfEbKL9kYJ0vn
MD5:	8E814DDFC630B77E9E11091E5FAAD44B
SHA1:	C8CCD1B3D3DF76007F89D6C2F07D66A81CB7E370
SHA-256:	247A2D17074314C26FBDFAF15BC220F6962DDB961329D78267560C5041DA19AA
SHA-512:	078CE265A3F1F87715746C3FD61EFFE8EA6BEDD779AA91B0836BF5ABD08731621EDCC079FF8A6306E36C6A0A63653ABD286A9A87CA2650F87B04CC24473E076E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa813771219a4ff8a58e58f9fd279490.IDENTIFIER=org.gnome.SettingsDaemon.PrintNotifications.desktop.

/run/systemd/journal/streams/.#9:71235bpjch2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.456323226876571
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MKSOzjsZjFmShmatvn:qgFqo6g7/+0+f+MKSOu9katvn
MD5:	7058643DDE2D14DD4D975E53C4527480
SHA1:	82D81F7E8B58D1137DDEA8FE298F442A97435937
SHA-256:	E1164D6316822342BBC3F4A6F13A5E0067FC0E6B4463D97A3200C302F3A8F7D1
SHA-512:	E6A48283C3BC17957FDF3762BFE0DD7ACEA508CFE600906714EB7BF25CB5FE4CB4BC22904390C7410CB6FD1DEBB06BE824E2BF58D7855A1839600FA812D59856
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=58e06e1ce7c34491ad54eb4427fcf38a.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:71237nhKin1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.455753999763542
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+My5QghZ8jFmShmatvn:qgFqdg7/+0+f+Mlg/29katvn
MD5:	439D8268BD1BA19E24318BB249C85D74
SHA1:	0C3D8635E24EC95F258FC668A0FC70B7CEB6E664
SHA-256:	11C065FA31EE39EAD1652D9951ABB62332111D233BA38F912E570C784310EAE5
SHA-512:	67EB78302CD446C044B3790BDFBED78E0ABA93E0F4CC8ED023B70CDDAE21A3E9E188AFFBA0ACE0D5251640079A5FF67EC9576616B7B757E90A5BB1C8D8B1130B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89769575ed394d18994e144eb3bfb5cd.IDENTIFIER=org.gnome.SettingsDaemon.Rfkill.desktop.

/run/systemd/journal/streams/.#9:71239pNE6e5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.433258017473537
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8bnVmqjFmShmzxvvn:qgFqo6g7/+0+f+M8zVF9kztvn
MD5:	775141FFE2925DC61A0B7BADF58564F6
SHA1:	5FC2C28639EF4C779436CC8EC770FDE0EC8F8ECB
SHA-256:	7DC2DD789933858D508D2925707623199247540A5A4BAB91774B370332C7D32C
SHA-512:	63FF1B7E8D7E2E9ADCE814B20F6E9FD0B75259D73D991262C05C1E0950FD95A6F5CC43397381E3DDD92807D1E269AA17E71D4BD26DE327EA65F7F7C980E120DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ed7c9b20743428594ca86031d5d2905.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:71240kEJ3Y4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.41287265926938
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoQ2d0cWtn9jFmShmzxvvn:qgFqdg7/+0+f+MoQ2d0cW19kztvn
MD5:	EEF3190B3564E7E3C8C05868A1D2DC56
SHA1:	4139FFEE4D56ABDE4CA6ED443E4115B42D644A86
SHA-256:	661D2C70EB55F6EE8ACAAFA022DD31C3F393AEFEEC50897F6130C138DD8C5498
SHA-512:	C8EEE30ED54E3E16825DC78C2539C72D5D8F69AAD1BA21711B59D321564AD0F7D3563370B824A9CDBC4FEFD4BA8D272B876DB8741CBDEDAF2C32F7C40AA67492
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b84bb6c90c4d45418507b981bc4f14d9.IDENTIFIER=org.gnome.SettingsDaemon.Smartcard.desktop.

/run/systemd/journal/streams/.#9:71262daxif3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.421451993670064
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsF/WDpIsjFmShmZBvn:qgFqo6g7/+0+f+MsApIm9kZBvn
MD5:	6597BE99B835A1BD55F641E3AAAAAE6D
SHA1:	D0ED8F30884B7CE6812483AD14D56C74B9C049D4
SHA-256:	6E8CCA45319053D2FB629BA8728EEDE7259208993598CCB6FAFA5FC3A573C670
SHA-512:	B4794917A6D0BB3C75E4C804CA2CDD775CF8F3F4BB477277B3424C6BA1BA77C06F499EC338E23F8C58CB5EDB094467DE92D21DF94BFD7E8E29534A60F8201304
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f7d328fb0fa743c38d8e65ee9158b266.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:71264NbnMx2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.375506982518671
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6/PFVTjFmShmZBvn:qgFqdg7/+0+f+MUF79kZBvn
MD5:	7C3E8C27BA9A9A487EBA575ADD4F2979
SHA1:	0AB7161E20E294DEACB408D10A8688D7CBD055FA
SHA-256:	7D70853368BB4716422D01B7273B6BE08A5F35B11A943999AE4AF1DF80C92C9C
SHA-512:	ED41E972233CFFC1D7E5C968559A9E230E51596F57CD36093F0D03957AED36404171A5BA71D8262C4723BF1B4BC7DCCA619B0B69D2F006D40ED6E509A4728A60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03b423ba35004c13b831e256ef4e465d.IDENTIFIER=org.gnome.SettingsDaemon.Datetime.desktop.

/run/systemd/journal/streams/.#9:71286AU9Il2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.445096690301247
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M0I0dHB2jFmShmwtvn:qgFqo6g7/+0+f+Mjf9kwtvn
MD5:	21C5FE21E9A016FDD5287C2876D3F69A
SHA1:	411C38958F5338B648C613627D386D9A08A568EA
SHA-256:	613BAA827C1EC988169F9708E96AC3C884928226341090ADA1B597F80B6D1B6D
SHA-512:	1497AC40C7BE8F5D6E02C21975407D78DEBC04E2B8CC55C09B0BAAE16CDC54757ADF604D56EB441B5ED9F6B445C452C0BBE4791BBD0518D27FEA332F444C52C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afb1f70e11614a839a2e15b757ccb207.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:71288c5e4D3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.391628626627517
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mu908xtjFmShmwtvn:qgFqdg7/+0+f+MRyz9kwtvn
MD5:	589FF221474E79A55FFFDAD86857244B
SHA1:	D27FE39987BE61334844A7BD82D796D7F970AE84
SHA-256:	71CA729AE636766493A43BE16997B1663F7DA95BF9EA1D51470941E686A2EC57
SHA-512:	959F0B2D56AB7721FB54A6B255186477880BD4736601992156BE4ADFD16C0AF5ABA24634B027710D4BBD4C24AF1DFF75627EA7FAE2D233C3FB19ECF33648B79F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d5417002bd0a442780ae389650a0e8c2.IDENTIFIER=org.gnome.SettingsDaemon.MediaKeys.desktop.

/run/systemd/journal/streams/.#9:712923PAlm4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.420971231130472
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4k7GQYgrqjFmShmkiEovn:qgFqo6g7/+0+f+M4krYN9kVEovn
MD5:	357D28C3F42E62181F2DB8AD0607B188
SHA1:	F868585D339F37147E4795C8AE74D8ECF42D2C07
SHA-256:	B9CC1207878D7C8ABAA61FAC717E29E24D4E8EDB2FE6A88FD0A168C9EE2B1D96
SHA-512:	786D257A373E1F1385F606E273A76E7AAD9F617AEDF7958F9DCF3664B68BC2488626CDD81C049FAD67330494662BD0EC1A88515B9DD2772A7C12902A5DA68C3C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a61900aac3d4a9dba88c9ccae931725.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:71293h5mJD1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.477121478634423
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4WpPXTTjFmShmkiEovn:qgFqdg7/+0+f+M4GXTN9kVEovn
MD5:	0A5A31DB943C23D593AD3BCA15CC0345
SHA1:	13FE5BD4A9ADE0340F796F41F5669951AC76294A
SHA-256:	9B5381136D5566AD0F71EF327436161F8D82CB94700C10743CDD8EB0638BF56A
SHA-512:	21C17A4575E7CD197C1C3F1CF2949AF2FE4157187471B13C90CBE517C862154B83878131406FEE3153DFB92D63E2A26C612CF36C57E6EC870A1EF16C1374AC9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=939b04b3632649c58db01dd750421086.IDENTIFIER=org.gnome.SettingsDaemon.ScreensaverProxy.desktop.

/run/systemd/journal/streams/.#9:71332vEbZN5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.3585851464335885
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+WvAEZjFmShmpvn:qgFqo6g7/+0+f+MFYEv9kpvn
MD5:	C895285E19CD115FEF63D715952E0A6E
SHA1:	B5CF73AE50626066976A70D328D178DB55ABB1F9
SHA-256:	BA3EBD53AD2D5A7BD2C32B7CEC74C5A0554860D8D5CD9E74F98D1D5875882778
SHA-512:	D095225B9169B900B577C7C497CE07B10FDA9AF6B31D24946FA5DF532224927149B832A505B294CF4B61CB8C980E2CE726AFA3A7595720AF70A7B9AFC681765E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=469ef3eaace54b2b9dcd0ad645ae54a5.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:71334bmaaf5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.4591703463620265
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+My/K1KQ2jFmShmpvn:qgFqdg7/+0+f+M099kpvn
MD5:	E434491159AA18AFD7DD3C2E553CD2E1
SHA1:	858A52E804B4A696C34BD58D0EA29753027039E9
SHA-256:	23C8CEAA76406299B42B7DE9040D3DE6AC04478CAC126C0AE4E948B1C97F95B5
SHA-512:	6C069357F3B3C9150F9919D5D6D92C4F0B8219A2AEA6AB7987E4D955B3F3459E277875E9D10C032B0D61DC64815C3EB0E5E7E84C889FE1AF73714A25542428F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8124ea749c9643f6848f56707abd2b4c.IDENTIFIER=org.gnome.SettingsDaemon.Sound.desktop.

/run/systemd/journal/streams/.#9:71356SEbDA3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.420754842988821
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Ms/rW50WuqjFmShmQmc0vn:qgFqo6g7/+0+f+MsTW5W49kQmtvn
MD5:	50C8E177FBF6398D81D48585FC5B8A6E
SHA1:	FE448B8BACC6C49EAE88E2FFB012B6105AF47ACD
SHA-256:	4A86408E1211744E539D751D2C501C110CAFB23EC55F9D574396127D6245FE46
SHA-512:	B79B5688B13C78C847ADFEA20AD90B6609493781391F47C28A50A9B5770C40ECD143DC41D4F732250D2146D15A837D9D3F36190F716960B25E6E7B52E3CFAEE1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fa5dfe72f40b4bb6901a7cb80662d7ee.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:71358agHrf1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.448608687268292
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MiEPqjFmShmQmc0vn:qgFqdg7/+0+f+MiEP49kQmtvn
MD5:	DA78CF7435F8A42D73265BD872916D33
SHA1:	0CD03134D4B9DF16FFB16454906FA74590859071
SHA-256:	88D4D6D57A7B3F380D1F36F263472B7746422773CB4AA1DACE8172EB24F8D76E
SHA-512:	25EDB1729E3CCF6F6F47FFC2482FAC839FEEF160F065FB241BC0B96BE3025F99E8C1AC6817FD6FAC3D773D24812C8EC874A8AC9BF4F298B8A90A1E38E17933CA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc9ffbcbc5ed407b9d195462bb9b3df7.IDENTIFIER=org.gnome.SettingsDaemon.A11ySettings.desktop.

/run/systemd/journal/streams/.#9:71363pqTr33

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4720468337451855
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mq1kgx20ZjFmShmx+0vn:qgFqo6g7/+0+f+Mq1kgxt9k40vn
MD5:	1FD6619300DA44642C5102F676D0E9D3
SHA1:	1C0070D8C728D32DC84F4D7E67967658A4EA7098
SHA-256:	DA6E631810C9B6AC05C1A3E41F4528AD8F9F715F3ACD416F279D037128546016
SHA-512:	7C4197E5F2D8C61D5FD434EDFD6166910B12C741D7819EFB7DFDB58142C40D34F109E2B73F2359311D1AF3A8B0DC4B0099523DB2A351EAB7A7CB80CBDEDD6F7B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9951e42283a340498716194cb453fa24.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:71364cQAPh4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.404724689206866
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MyE645qjFmShmx+0vn:qgFqdg7/+0+f+Mybu49k40vn
MD5:	11995FA8C133FE324B69DB741488C02A
SHA1:	2927571361EAB55C6AE9ED8C9A4EEAE03355BB41
SHA-256:	66289DD0D7DAB7C71376E558DB26B57AA64643B81697B01F8D13F8D6CFF5CFD1
SHA-512:	60CF00C7F28BC878A481DB2A928866DEC7A6B3292790912276B6381440D281BD47146491BCB525092F1CAD88EF20FEB47A7E1D26543953C22A9CC5A74A0E8868
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5405e90da497426887c084e628f5645e.IDENTIFIER=org.gnome.SettingsDaemon.Housekeeping.desktop.

/run/systemd/journal/streams/.#9:71366THOnX2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.390919178862498
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MQyzQ8Q3jFmShm3vn:qgFqo6g7/+0+f+Mbx+9k3vn
MD5:	9A870B21CA46C465B145D2E120454A98
SHA1:	64E8F6F24455093CFDD69AB5047A03D79C1102B7
SHA-256:	CFB9A5395A59F41198F3E2F901C9EF86F5B1FF9AFF88F9B6E9339560206BDB55
SHA-512:	D831C510368A76EA8EFB41861A7F41BBBD10638B689306F135614F1E18FB57FAD000E1D965FF3276E0E9973CF532446BE3171A2D698C0F2563DF7DE17583681C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e69189da273a4470aab2a0497e553a46.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:713678tyHr5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.41805992523984
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M82PHSpPd8rqjFmShm3vn:qgFqdg7/+0+f+M82/m9k3vn
MD5:	B25B6AE86B045499B48C8F5728B8DC4E
SHA1:	0571D91F7517959F22C0BA3D06FC18476F63E0EE
SHA-256:	7AAD375350D562EE75AA314D0A84B79A797CEE5E8AD00B9064FCB13C90939049
SHA-512:	E4D503FC0B2D27D477714CE5759F39D77488BC51060CBA97B93A7F856C2F2CBE20943ECEC9BAC6DB8ACCB89769C597B3AC71935F8FCF6F2F1AA3564C7AC6C9AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69bab2ccbd284661b760ed337d8d68da.IDENTIFIER=org.gnome.SettingsDaemon.Power.desktop.

/run/systemd/journal/streams/.#9:71390rdMkR3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.428821739644343
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyqUNB622EAqsZjsiM:SbFuFyLVIg1BG+f+MyqD2jGjZcHdzqDq
MD5:	BD89702550A60BA39385F19F4BA93410
SHA1:	09E12017CFD584306125D1FBAACBE7B781F8DB0E
SHA-256:	F5AF86FD2FEC8E4DEEE0C852E66F73057F9EF406C135A992CF3DE24FC0841996
SHA-512:	E59AD8D50BD01ECEBCBA702482BF3B78503C410E27E2FBA607518E31423C65FC99EC1A7E51F69E799EC84BCB6B2F74939CB602AC04F6684335BA2A42F9F8CB97
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8710ecfe55c24c7e9a672740a25a51b4.IDENTIFIER=systemd-hostnamed.UNIT=systemd-hostnamed.service.

/run/systemd/journal/streams/.#9:722514jhru3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.410558247962023
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpATBVX2QltnFATjsx:SbFuFyLVIg1BG+f+MOTL2QltF8jXjK
MD5:	99F939693CA626930C2A08FB069A96B4
SHA1:	CE6B1AC2F564E616316A06202017BBB36F29328B
SHA-256:	C5BBDDF3F4A15F688F79CDDC40B8AF1BB388D6F7CC4EA4BCE770BBA5F95D4817
SHA-512:	173EF34332D2F796C051BE8CC089732D2145C25CB8E83D478A3B03714687C6251D524B05E71C0B955FEAECD38668F5EFCBFF89A56BB88AEFDAB1C64089314C7E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c98564a65a174262b1cad65915ebbb37.IDENTIFIER=fprintd.UNIT=fprintd.service.

/run/systemd/journal/streams/.#9:72266HsLn83

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.396385927540484
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MWJG32t58jJKJMBNr+:qgFq6g10+f+MWI3456K+NK
MD5:	B7A09391D13872653B042514788C40E1
SHA1:	B28FE39FF674246D766A852DB6EC1BE03E3D9E3D
SHA-256:	D9912F0D8FA7C8E7C0F5C611DFEF10E4918F6B5B83C86807C28F2144018BAEF1
SHA-512:	C0C6C90210FE6E11EB6B7E45EC3F99E8E74D7EA9BE2E50367542C02A7BA80C924D202A1D505C2D06D63E1AEF4E928B698664B851ACADB812E9C9A4879954CAD3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=729f0c9c4b78405aaa2b4dae8963d64f.IDENTIFIER=colord.UNIT=colord.service.

/run/systemd/journal/streams/.#9:72801A8w6Z2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.40820597652979
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7OBQMBLEpcYTjsjOw:SbFuFyLVIg1BG+f+M9njhD1DTu
MD5:	7E31C85B03BC33F8794724018006A474
SHA1:	64CEE4DD4AF4836E53A9F50321BF7166447DAFC9
SHA-256:	12469B79B1E9F81AECA1FD4DB41E517137DFC198EA7BFA6ECA8BE82FA0E918C0
SHA-512:	3B934946D6537C4AE9E4D12CA7F7DD00AE2A283C07B5D785270FE5535CF53B2117329E260DCDB16DDBF97D883B1A714122E3843A5C03739C48D19578978C100C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c95135e42b5467fba7d9b045ba24009.IDENTIFIER=ModemManager.UNIT=ModemManager.service.

/run/systemd/journal/streams/.#9:72836jWzVA1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.3967949384722225
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6bssH0QhTjZarvn:qgFqo6g7/+0+f+MhsUearvn
MD5:	920C443365A3143144996B731B35E6A8
SHA1:	08C1D0E42B9A4E234A7803879C4321507BAE4ADD
SHA-256:	B490B206F95909F2F311DC1A27575AB2232C63DDCE067E365B64FDCD12990703
SHA-512:	382CCD58B35F35E2DDD5D78A646C50E7211553A81F1118CD7177D29B82DC60CE41B7E889B10DF44BEBECEEC077292FDEC1CFE4242D53DF0A09EB2CAC0B4CBE9B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b128c377caa498d83ade57a99984d26.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:72838IAbvt2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.374540534651178
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsGEVQA5ObxASc04:SbFuFyLVI6g7/+BG+f+MseTe0ZjZarvn
MD5:	F0FAEB2341A76F67B66CE4A3EBC388DA
SHA1:	32CC32CCFBF98B1194AF326C0B0103B0B9374A9C
SHA-256:	9D321A5AF0521EEB8CAC312ECCBA9201239A3668862FFF6456AE7CFB7DF651B1
SHA-512:	2E7012EE1CDAF42E14A150ADCB8ED512D90E568184DAA4E5BB0FF019AFDC5B5C6B8F5EF99D9E353D96194DB0781C154D7C5A9C6EA86573EBCD97CDC6A1A7B457
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fca0ba2702ee443b929c83bf3eb4e859.IDENTIFIER=spice-vdagent.desktop.

/run/systemd/journal/streams/.#9:72891OZQFv5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.355535641758028
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm8ASrD2nTdnTzwv7:SbFuFyLVK6g7/+BG+f+M8lHwRnnwvRq2
MD5:	4EA2DFE3EE1EA8244AB7ACFD8DDB4875
SHA1:	AE6C71283B6261E3804502E31B42E760CE1142D6
SHA-256:	760FC97F06F625A86AFAABFAE526D29BD1974E9429F2CCCA38D1266263A34FD2
SHA-512:	4EDCDD883E782C1160C7CE910B6B2C183BDFC62F27F92CD84A0B13EAAC01CCB5951DEA97A43687F0A499743DE53DB81F804F6FA0CF9BA3A6F2E5D4DC3A801AA6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e78c90d3a9b4a3683968936b676af41.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:72893hES8E5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.328351886815977
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpKBAcHTMKVrT722:SbFuFyLVI6g7/+BG+f+MAB14a2j022vn
MD5:	0450D955459BA4B757C33CC90CCEAAE8
SHA1:	D63F40BB08AA05B9B2CA4FDF070E043D9A49B7D9
SHA-256:	401519EEA8CAE9F1CD314AE69AE5F4B1DCA4B25AB01D1DB3FCBE9F7E377F966A
SHA-512:	8C0894668D4D98A2C1BD096428F1244A38D59CD3F2218323FCFBDDA0CD56CC473283C36BE4E291B67F2B406E5C1D6B3D35CD279BF1A20E33446694987696E375
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4795de903384cf0bd344f0440d8600d.IDENTIFIER=xbrlapi.desktop.

/run/systemd/journal/streams/.#9:72955Js0vH1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.355883527921359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DX3WnLTr7QNlsjs4:SbFuFyLVIg1BG+f+M4Sjs0joa
MD5:	D8DB65B5F6D6D7E16796E9F2BB58DB06
SHA1:	CA6DFFBEC3ABCB6A3C0B17DB2D9C7F571D8E39E1
SHA-256:	8AFE401227FAB702525168533E968C5F9B237CB4740951341B78AE387F45AC64
SHA-512:	E92778E63AAD34DB61950BF59E4E02AEAFA837BDFEC3C64C55420C18E212FFA0CADAC4AD4F9701437248C5AD68654E66DD1923FE5CB172A414B16CC45EF4C1F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=28d2b234d6b845388287d438c36b601b.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:729565iYBq1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.33874160734837
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7lhQQx8m8c0TjshQJ:SbFuFyLVIg1BG+f+MPQvmqjtWL0
MD5:	F797E71D0A9E1E9F59A4D30182EDFDC9
SHA1:	03854F3A61C36E90C5F23F23DD979A865B0FDDF3
SHA-256:	C760D553B40EAC2FCCF42C0244293E7514E1BBC8F8C88844724EB852F234E336
SHA-512:	69135AF79E3C4A5DB67D8D59A2EA7B4F43872AF66792AA9E030FB62E861D72470A01BD98A3D6925BBC2230B4BF29D79615EBF942CEFF0B0F9FFEDCF08A388133
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14fd2dd6ed1049eba37292dcbec32c96.IDENTIFIER=pulseaudio.

/run/systemd/seats/.#seat04usPvU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0A8EsGY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0DaGdaT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0SznhDU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0dWwqfT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0gVxrsS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0rVEhsT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0tR67oS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/sessions/.#c12JnZnU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.500510512871282
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xffgBxfx2xNIByy6GBEm0JgDsR+fY2:qgFqPumVuRZI4BIB9x2xayWnCgDso
MD5:	CBC4CF9ECAD1E82665BA8A1F22504F79
SHA1:	CDD1D01DC29EAD587A730541E803DA031F6CBF1B
SHA-256:	88795056905033855DDAA29955DCAD2A3E168FF8998DAEB686E516687FF43FDF
SHA-512:	80FC48915BFFEEF75524BF20B60E16DFD128E10F2F67CA24A51756246BBEA46A8E3E9A36A669B07F3A9530E7A735169D8034F35D49A54AF5454D9A420F46EA7C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8251.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c1LVG1zS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.440082294031098
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBEm0JgDsR+fY2:qgFqPuFN6IG0n99x2xayWnCgDso
MD5:	F2913853A764D553AF2ADE2DD6583FCE
SHA1:	75507428FE3B04BA7CFD2DF6929AF0A8BA9AB828
SHA-256:	8D51D358A5A623C8E96FCF1B4DAAEA5D3A8788DB0E3155E9198124BD4D27A2BB
SHA-512:	AFD5BEB4264B7CA291F497DF412304672B5DB7D131D22A5A641F524898BE9EDE1FDC5911C7479BF5274E0B6CA24F2171A412ECF29672AFD2233317B9B82D5B2A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c1RXuMVU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.440082294031098
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBEm0JgDsR+fY2:qgFqPuFN6IG0n99x2xayWnCgDso
MD5:	F2913853A764D553AF2ADE2DD6583FCE
SHA1:	75507428FE3B04BA7CFD2DF6929AF0A8BA9AB828
SHA-256:	8D51D358A5A623C8E96FCF1B4DAAEA5D3A8788DB0E3155E9198124BD4D27A2BB
SHA-512:	AFD5BEB4264B7CA291F497DF412304672B5DB7D131D22A5A641F524898BE9EDE1FDC5911C7479BF5274E0B6CA24F2171A412ECF29672AFD2233317B9B82D5B2A
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c1V2lsXV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4390382457270885
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBEm0JgDsR+fY2:qgFqPumW8IG0n99x2xayWnCgDso
MD5:	43E95C6CB08220740450D00E622FFFCC
SHA1:	072740852F1E729ACF91F742300448AD86936397
SHA-256:	31DC2AB7235B9E813A97F46AFD1034280AFF7881AF480F6E6B28564E62F893A3
SHA-512:	98E8F34CC1339213FE57817547D68D52D684F5A09B75C761191CBC03215ABA1532F893CE26E0401C510BC882B0611B47B4290B63D41A470DCDB55884B67CEA94
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c1WFaLXT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.453100544454762
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBEm0JgDsR+fY/n:qgFqPuFN6IG0n99x2xayWnCgDs9
MD5:	5387A2FD6C5BE5E682AAC9F8237759E4
SHA1:	BEAF09161F2F87D39D96699A2B583CD1FB4D413F
SHA-256:	75415CBED6581250AD93D2D8707997030EDF948CABE171E6718479E69859D5D2
SHA-512:	3ADAB10E1305EB03AC18FD737B9C86A443D3B06E4959066FBF43B871A1AAD3BA108AEEAC720B8D421EDBE580A01BE3438F236ABB82F9B027983B6071EAA9A04C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.CONTROLLER=:1.9.

/run/systemd/sessions/.#c1cR4DvW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.39835723426785
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBEm0JgDsR+fY2:qgFqPuFdDJIi9x2xayWnCgDso
MD5:	92A1C0B0D202FC14AAE569AA70F5F736
SHA1:	7E86F8849D6EC69BD11FAE355F42B20ED1FAE8F5
SHA-256:	185BA82CEF2192BAB2E1A024742E23CF57B556E73C5309C2D61884C2681616A0
SHA-512:	16FDF915AAACDC152A15BF9309869D712D5ED18FA0DB87CAC544DE85292273DEC32E5FF0FAC7B72D77CF46344B366101A84D7A8A8EAB07DCAC187E521F2F79DF
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c1vw1XWS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.4390382457270885
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBEm0JgDsR+fY2:qgFqPumW8IG0n99x2xayWnCgDso
MD5:	43E95C6CB08220740450D00E622FFFCC
SHA1:	072740852F1E729ACF91F742300448AD86936397
SHA-256:	31DC2AB7235B9E813A97F46AFD1034280AFF7881AF480F6E6B28564E62F893A3
SHA-512:	98E8F34CC1339213FE57817547D68D52D684F5A09B75C761191CBC03215ABA1532F893CE26E0401C510BC882B0611B47B4290B63D41A470DCDB55884B67CEA94
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5806.REALTIME=1736209793054407.MONOTONIC=152123667.

/run/systemd/sessions/.#c23loGnT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.442662695468154
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgyt8i:qgFqPuFNuCH0nI9x2xayWegDF1i
MD5:	4B1827C752B8AB9784571C9E1671AB7B
SHA1:	51460E71A8281ADFA065F575683DFBB398C3CF1B
SHA-256:	3A9798E0AAEC5B7DEE45E826EF93DDA59C59FC410982D475644FAE64DDFC430E
SHA-512:	BA8B37227E81AD27939EAEBAFC763B1A901790EF4057EFA0529A105E6DD4EB7FC19C8A19DE4049BD251B3B090AE9A6D74E1DF20A48D1FEE364B2DB6AC2A20F27
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.CONTROLLER=:1.13.DEVICES=13:64 .

/run/systemd/sessions/.#c26XfOLU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.453009897227809
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgyt8nn:qgFqPuFNuCH0nI9x2xayWegDF1n
MD5:	EDABD2F33141568DA7E1D7D857692E66
SHA1:	7E680EC18308E8AB658FA1E3E6094EB4C7E41B62
SHA-256:	712BEE3237B40C8C36F70CDCEB1B0B02C5E63FC7796B30D8722A5488E542FB57
SHA-512:	804C7B505912E83F485D15928A97A63DA32AA0907EFDA4E0BC69E1AA5E1DD535735EF2884CA0A8AF54261A14A7CCAAC43EE2E3F5A1F1F4763F5D5304AB2E7B52
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.CONTROLLER=:1.13.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c28gFvVS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.436835532608352
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgyt3:qgFqPuFNuCH0nI9x2xayWegDFc
MD5:	D771FA6E33FB6C62E5EDC82F63ADBF24
SHA1:	593AC8F2B0330AF557B04C72736ADD1CAE78BDC7
SHA-256:	4142E0917C6269325C67834F0D1BABD422E584CB3A806514FB87CE31358F0D63
SHA-512:	BB28C98ADF498B44EADDACBD782D02D3889DC40D3911FF7B8DDC767765E4A0F60FE1BD0D51B4EAA39412C7149C02DC01D6D83EF69E48F9ABE4EF57A31342F9A2
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.CONTROLLER=:1.13.

/run/systemd/sessions/.#c2XNW8KU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.458644277189901
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgyt8Tk:qgFqPuFNuCH0nI9x2xayWegDF1Tk
MD5:	519D753048A909B14AE340DB33C65782
SHA1:	AC9FE9CFE840D4DFE730F27917D876F9807CC886
SHA-256:	84D6509AC6F32639688339D01F40CAE4E03B9E08E69BA69DA11F0731BE78CB43
SHA-512:	A22FEDAA63F5B3B44E4D2050E16C34D95C708AC09364C761DC0F1352FF63E8227D819BCEBA81000A4028DD7EA8B49310171D2E0791EA2CC37D0FB08991D6519C
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.CONTROLLER=:1.13.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c2aaNGzV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.428290184597551
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgk:qgFqPuFNuCH0nI9x2xayWegDFC
MD5:	F5DF51A90A2AF2276B93EFEBC18744A6
SHA1:	01C9FEEF32B3A68458F0CAC5B651E24487B86F3A
SHA-256:	5AC74F598ED26350C7C90D952B48450709C2EB44D0F60BA0F3D2562B4F11A167
SHA-512:	47C6D051BA791E09B62A69C2651E740C605A4414F28649D609DA95AC48E5C391224AE99C38F8F5C8D8E26136A58BBA9F8910965F292C662F7E40B8CF67A0FFB4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.

/run/systemd/sessions/.#c2ckYMyS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.428290184597551
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgk:qgFqPuFNuCH0nI9x2xayWegDFC
MD5:	F5DF51A90A2AF2276B93EFEBC18744A6
SHA1:	01C9FEEF32B3A68458F0CAC5B651E24487B86F3A
SHA-256:	5AC74F598ED26350C7C90D952B48450709C2EB44D0F60BA0F3D2562B4F11A167
SHA-512:	47C6D051BA791E09B62A69C2651E740C605A4414F28649D609DA95AC48E5C391224AE99C38F8F5C8D8E26136A58BBA9F8910965F292C662F7E40B8CF67A0FFB4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.

/run/systemd/sessions/.#c2gNP8BV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.458715928788239
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBE5xJgD2AMgyt8Ten:qgFqPuFNuCH0nI9x2xayWegDF1Ten
MD5:	5C1B6FD4F8C97E8E5A45F2D90E73724C
SHA1:	F446137630C7EA2DC739A2CC88A36540B42A63F9
SHA-256:	E5C964E4CCBA27D89722AC1652E43175EA3CF84418BD4D45497335B472757B69
SHA-512:	43BAA0502171DBE90A3E23F5CEAD4ABEC0AC9A96D723E61DF14AE3F2EACD203AB0686CD1999473F944C3B820847D81E87C0AAE08B34DA955A51D236A098A48E1
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.CONTROLLER=:1.13.DEVICES=13:65 13:67 13:64 13:66 .

/run/systemd/sessions/.#c2pNdiaU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.487475879487191
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffHv8xfx2xNIByy6GBE5xJgD2AMgk:qgFqPuFVuRpCvBn89x2xayWegDFC
MD5:	2130A9E3CE4D2209E5F91B13EA55F7FA
SHA1:	3B8FA71DD86D61B830A93F6BA46BF0055134DAFC
SHA-256:	9DA9542C788C8E6C6BA53BA647CCA652164ED12F517847530460AB68070EC5DB
SHA-512:	5B6F63D4FE457944CAB601491B32F72BCEE41A3999EA18F34C2A2C3A0ED75847410EC43D3B90A8569747011956D55AEA0D8D92DFA6212D6A9D3ED4C5785138FC
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8314.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5846.REALTIME=1736209799933003.MONOTONIC=159002263.

/run/systemd/users/.#1270D1GFT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.16226496492655
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgDBp2nQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgDL2jz5HzwPzbA
MD5:	EBDA7C0D6DA932A255EA48C407111376
SHA1:	1337F4F9F22E5E8F34A86CAEE8D3B42982F1B2B1
SHA-256:	9653EF65727A1C045B5DA370525EB99C1D79B9C9C0A056058E60CA2FCE3CFA28
SHA-512:	BBB1BE248E3746037B2D165291C7DB87539AFAD668D2B18443026936B8D8B494862A2A79B317B2238AE5164B258721A0F0D8EF34831E325345F94EEBE80253F4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1273OjpvT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.29566475081939
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffPgDBp2nQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBngDL2jthQHtPYq9M
MD5:	575C1A871135C3A0E47177D05AD0E172
SHA1:	5E80A39885E21CDCDB6080D558D5B79067B90D75
SHA-256:	C90169E67CDBCE0FA4A25827837BA7D01C7D2BF47E816307B6B30B0FD990DBA6
SHA-512:	7C47CF935C472A803EB6CA514843E8A4F09239CCE290FAD4976820D4DFEC6E55B35A29AE397702FE899B3C24B92773844EC9C65C48D09894D573877B33E1037B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8189.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278ERpsT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.155438945407699
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDBp2nQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegDL2jthQHxbPnmDd
MD5:	D0E99B9A82634A906775CEA0A427EDBD
SHA1:	EAEB998D09B54FF940D75D277E552837DF045B3E
SHA-256:	EAAC1824B2878ED79B1B4C0EBB631EF6347A25D5A38998729CC8388B3B9E9C8B
SHA-512:	217AB1B2420D403A30AEC30024B377F9825DFAA0CE3C3596C723A9D27DD16515D5BD53439012DE199E11218DB06F5105CF7206B37D8B906ED1D893CE16670031
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#1278vg3bT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.140404563507426
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgDBp2nQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgDL2jz5HzwPzbA
MD5:	8851AF89BD09E538701CF185D947537E
SHA1:	8DAB4E2C4CD6730EF9CC46236748CF6A056126A5
SHA-256:	CC5E8A29C0962F29BC07621779ECEE000B389383FCDB76A1B609C390F8621B80
SHA-512:	4666A2AF79110553078F30287E66E0E199419ECE43541BFD9F94050143B7784AC364ED94A1A5A4FED805651827757C7BD24F2890FFCB9F75BE2183E6794DE156
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127U39SVR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.146328709946469
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgDBp2nQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgDL2jz5HzwPzbA
MD5:	44BC6C4B3158FD2D31046CD784178236
SHA1:	832DD5260F81CCF2F26F208AA81F18D208742379
SHA-256:	4B549FE8AD9470FBD23579E4D669AC7B84B126F1D37F800C27479E4C23A229C6
SHA-512:	93D56FECE9883B320D98F90D6FADA32B1FBC574F3B5F594B84A7B47199C13CD30EE26BABD75FD2E875A57C8EE7B49DFCC45773A5F17A5239917055B5C703670B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127WJfmFV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.142916723096442
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDBp2nQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegDL2jthQHtPnmDq9x
MD5:	40950FE5A44D88781CC973257D303E8A
SHA1:	FE8510FD7DCA8DDACFAD5C09E6D906DD9F6B6C34
SHA-256:	65573A7A86E0E9D187884DA6FA4F1D8C0D064C60D18AF446EF790CD20494C532
SHA-512:	E85BBC9AB243CC042544B7C4E2C65BB5069FD374776EB186A2CC004E44825810C1D2AD3BD2A5CA14608650254EA6D4B2E94433154DA19F5715ED906D1E6B304C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127fPif9R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.136757939625326
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgDBp2nQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegDL2jthQHxbPYA
MD5:	53927E387DFE911ED46F9886E6F22E34
SHA1:	6FE3641B1987DABA7AD32AEF80025EEA8444D306
SHA-256:	1865D9A7CA573FE8F08925DD479C023386AB40579C965C2D175C5F80A75D7443
SHA-512:	6C3CCC0E22460D5C60A2A34AE6C274135EB7EF46A52FD9B606051F958751119F71A2557DB0C37D6B39D480C74A52213F77F35014C982ECBE8006BBC78CC1AF3D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gcMuCT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.315185331558922
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffsfgDBp2nQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBkgDL2jthQHtPYq9M
MD5:	00782E6E5890FFFCF45653A9665ACAC8
SHA1:	DA0CE92099685E85CF897B9910C2007FCB0FFAAB
SHA-256:	67A135CF09E2023166C46E121FAAAD77BE6386C8C34DFBA6BBDFBF24F6D166E8
SHA-512:	DC59A82BAA77E6D54379B812B75E0D5F1E70691C3B858B3A5C8CD193AC559BFD7DA7D022D60D7F18F9B4ACCFCA2CFFCF0767268DA444BAA9C1679CEBE3DD47AF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/8189.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127n5DYoV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.142916723096442
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgDBp2nQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegDL2jthQHtPnmDq9x
MD5:	40950FE5A44D88781CC973257D303E8A
SHA1:	FE8510FD7DCA8DDACFAD5C09E6D906DD9F6B6C34
SHA-256:	65573A7A86E0E9D187884DA6FA4F1D8C0D064C60D18AF446EF790CD20494C532
SHA-512:	E85BBC9AB243CC042544B7C4E2C65BB5069FD374776EB186A2CC004E44825810C1D2AD3BD2A5CA14608650254EA6D4B2E94433154DA19F5715ED906D1E6B304C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127opHIaT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.145832802779451
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgDBp2nQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegDL2jthQHtPYq9M
MD5:	4A95C12B96633115D467682BED8CADAB
SHA1:	5463DDB6C60241796E4C11542209629D855C812A
SHA-256:	A38E5CC45438F99F250246AFA0B2391762A6E58471CE390A854F5AD1A9BBA019
SHA-512:	F11671AEE775AC2D03FC85D7DEA292549185606CC614F5DA7DB40263114840714D6331DAF0B52966AA5A4D430198A83BE736B227DB9E35AFB65C60903762EE2D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127tnYbxU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.145832802779451
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgDBp2nQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegDL2jthQHtPYq9M
MD5:	4A95C12B96633115D467682BED8CADAB
SHA1:	5463DDB6C60241796E4C11542209629D855C812A
SHA-256:	A38E5CC45438F99F250246AFA0B2391762A6E58471CE390A854F5AD1A9BBA019
SHA-512:	F11671AEE775AC2D03FC85D7DEA292549185606CC614F5DA7DB40263114840714D6331DAF0B52966AA5A4D430198A83BE736B227DB9E35AFB65C60903762EE2D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1736209793044452.MONOTONIC=152113711.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127uBii9S

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:kn:kn
MD5:	32702AA062D6DC4F2D1E6DC1E8050ECE
SHA1:	D169CD75F950BC0A407B4999C8B7609E6E273043
SHA-256:	5267311F445CEF88F74EA8E6F8EF80A6BE2D461BAA9D0E91CC86926857437110
SHA-512:	9FF93F1935F39C831FE0C2D365E19C5ABEDC4F6E2A29E2E6B9AD0537D674511BBEC78AB69F2DDDFDA5ECCA97FF96EFCB69174223EB51C4B7F7A9AEF62430935E
Malicious:	false
Preview:	6685.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.9877576215552235
Encrypted:	false
SSDEEP:	12:OxPoQoveY+omxPfYAPveY+fYeXmxPDQXwveY+D44xPUBKiveY+U3BQZ0veY+UXBj:SG5XIr86BPav1k+1lr8r
MD5:	CF5AAFD5D18D588083F9718F205BFC0B
SHA1:	3626323FF72C4C09E784F025FB1E7147DD4E0216
SHA-256:	0D3F7523A26227F3084AD3B7414B6C34143E096392F7F8E44061E41BB0BD538C
SHA-512:	2DFE69A661836F6AB89BA9961343269065F53642F30275BE44DAE3F5162ADD15E73926E5703146864590E1628D3616C58F97B4CAC02A5104C096959AAFB341AF
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5869..MIT-MAGIC-COOKIE-1...l..Z.m...+...]...XSMP...#local/galassia:@/tmp/.ICE-unix/5869..MIT-MAGIC-COOKIE-1..t.O.....t........ICE...!unix/galassia:/tmp/.ICE-unix/5818..MIT-MAGIC-COOKIE-1....t9.pc..>...Oc?..ICE...#local/galassia:@/tmp/.ICE-unix/5818..MIT-MAGIC-COOKIE-1..?...Pm6%..>Vh./...XSMP...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1.....w.0......F!W...XSMP...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1......,mN..b7.....ICE...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....]v1..".?.}.....ICE...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1...o4...6]..c..f....XSMP...#local/galassia:@/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1..N.#r......S.....XSMP...!unix/galassia:/tmp/.ICE-unix/1313..MIT-MAGIC-COOKIE-1.....q.p.."LS.DM(..ICE...#local/galassia:@/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...]...,0..2...`..ICE...!unix/galassia:/tmp/.ICE-unix/1383..MIT-MAGIC-COOKIE-1...y.&.O...j../I....XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.930316181388036
Encrypted:	false
SSDEEP:	3:rg/WFllasO93C38wRlxNWFllasO93C38wn:rg/WFl2Q8mxNWFl2Q8w
MD5:	E12FE09049FEF206B6EB4AE0D47E80FD
SHA1:	3FB0C4A6B6ECBBFDD8A99E04C2B67A24AEC73286
SHA-256:	829737BCDE2E9A9DC4392FB9757D3B04A73086C6BA601A33311657C91D6F692E
SHA-512:	D0F6B6A3207845CD4774C5871A61070BF526EC7FAAB8B3C82DB4C46376D02D16232332B391EC2E74EF7281D105A9FA56BB87FBE51904F33A33CC75DB2A55176D
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..(....%.r..^...9&....galassia....MIT-MAGIC-COOKIE-1..(....%.r..^...9&

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:76:2
MD5:	A71DC8562C058D4FDC841D9B5A989D79
SHA1:	4AD55C4316CA718BA6B1D1A233F711FAFD7C066B
SHA-256:	342F795E5D54656AED1C303EC438356B3302931ED74071912F8DAE1584E8B822
SHA-512:	254359DE3F9CA1DD853A3B28D83F70C9AE396F09539AAFF42A3FC58534263A8EB08807434C0A2CA436994A7E2F49013B8A8055484806D6ADC9096CB9883BA363
Malicious:	false
Preview:	6135.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:cCsXlXEWtl/QJsIutl:cf+yloJAl
MD5:	F30FB660E78AE2AB9119BF52BD30EF6A
SHA1:	E8837DFF261910B1A65700C3D5C9384ACEA4C35B
SHA-256:	FAFB92F5DF6B6A782975FB2243602E99031AE9DC55C24F0C8A1D0B7AFB2E41FE
SHA-512:	C97D8ECC110A05EE2508167BC4AFE70B53C4213DC37BEEFE53B4D517416B30EF90DBE0D5E70891C8BC95E234477EB0221702A5BC1965F3DB96A2576AE30ADB71
Malicious:	false
Preview:	....=...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................=...su\|g.......................................

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.5Y92Z2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.FJ1QZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.100201653101901
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW3uQbSu619y:q5sU3LWfLUDmQymqSFbfomSpuTu6fy
MD5:	7338B4AABEAB60861BB79312FCC6C112
SHA1:	D7B5AE9E56EE28B91BC6499FD652AE7409D8DB9E
SHA-256:	A305AA25A2270A024990142C191CC8CA512C39DFB4AEC14F4530D23113455C88
SHA-512:	7FCF475D855BEB361173B0666D3DC27C826624251FA1FB397A9130DEE37486CDBF40C9A792BD18EAE165ADCCCBD665B1E3263BAE65936B8C3FAECA23C2210F2D
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-sUuaN7bF,guid=cbd209a3bd0c9be5766c065f677c75a1.IBUS_DAEMON_PID=6016.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.284648497112529
Encrypted:	false
SSDEEP:	384:sG1se7psXMDdFdRdAdvdTdedrd2dKdTd3dVdBdzdfdadPdidJdJdLId++dlXd/dC:J1seVNE5d/azTkX6KbfUIUn
MD5:	DD07F985EE5560233F23A707BCAA50BC
SHA1:	8FFFF5B5CA2933B3EFA2816B75C2961C3A3A8938
SHA-256:	B2430AD236669BE063FE2B6997DF25AE6B20FB3169FDC43F3D1DC2D35CD84557
SHA-512:	A336E8B2206A874867E3FE8FB447F73B12AE53C6B7132049FE7A2256F41645AC87CFBF5447D0001254564633DB8476E131820AA1F3F65F36D039474259B4CE36
Malicious:	false
Preview:	[ 159.641] (--) Log file renamed from "/var/log/Xorg.pid-5853.log" to "/var/log/Xorg.0.log".[ 159.666] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 159.680] Build Operating System: linux Ubuntu.[ 159.695] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 159.704] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 159.720] Build Date: 06 July 2021 10:17:51AM.[ 159.726] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 159.733] Current version of pixman: 0.38.4.[ 159.740] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 159.748] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2133
Entropy (8bit):	4.989269919615141
Encrypted:	false
SSDEEP:	24:wZed9Z4ITZ3XiAv1A2+VQF6Fd2+dcXju1Nu0grboQpgrCQUJygrCQU:dvKfVQWAzjrbo3rC3jrCn
MD5:	6E0342E108715DA59F99D2B0693685A1
SHA1:	DF2FF79C6033CE03DAD8240504156B4D81607C50
SHA-256:	DDFED6AA9FA823D4C7B93B049F84F5984A96DE9C71D395462807B2A05BDBDB81
SHA-512:	73C9FEBA8BE0AE9952E32BBCC5651EAB021A73A92E2AB9F91DDFC51EDA93485528B6DF6FB5C6F660ECB70E5E24592D14C45E2B11E679AF06ACF3A92F6C512C9F
Malicious:	false
Preview:	Jan 6 18:29:39 galassia systemd-logind[5696]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 6 18:29:39 galassia systemd-logind[5696]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 6 18:29:39 galassia systemd-logind[5696]: User enumeration failed: Invalid argument.Jan 6 18:29:39 galassia systemd-logind[5696]: User of session 2 not known..Jan 6 18:29:39 galassia systemd-logind[5696]: Session enumeration failed: No such file or directory.Jan 6 18:29:39 galassia systemd-logind[5696]: Watching system buttons on /dev/input/event0 (Power Button).Jan 6 18:29:39 galassia systemd-logind[5696]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan 6 18:29:39 galassia systemd-logind[5696]: New seat seat0..Jan 6 18:29:52 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 6 18:29:53 galassia systemd-logind[5696]: New session c1 of user gdm..Jan 6 18:29

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4226312153993532
Encrypted:	false
SSDEEP:	3:F31Hl+R+PJq//OR+PJqP/:F3umqemq
MD5:	0F0B83B25E8283542FAFAFF3F60EA41F
SHA1:	E1D9872F4D3B84319D8C433FB2185EC6B9174565
SHA-256:	253BCB2E35BB984FFACC3E783869E1430039E18FD11074BA171FE215CE9AC15F
SHA-512:	289D3DBDF19A991A9B52E784042BCB5EBB54489121E8CFA499D06B479BD0F2F4920F0D67B9CE7B0B7777A7F15FE587230589B9365D34C5DF62E74FB3E62331C7
Malicious:	false
Preview:	LPKSHHRH................g84...H._^r^...................................g84...H._^r^...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.459526019450492
Encrypted:	false
SSDEEP:	3:F31HlPY5v7mXY5v72:F3s7x7
MD5:	97590C4337309D48DBFE0DEF3B73E900
SHA1:	A3BCBCCDF755B973BF2FAD5A30F25F37548737DB
SHA-256:	481E2DAF2500BD0666898A53D3D09323A4A996A99F85C0A038BB128654C2D53D
SHA-512:	42A72BC5884BA864753CF4AF428D875652B698A8028952B98525FD7320BE712B673E734AC6C26832C03A88D0CECA0DDF619AC21C63066161B990AAB1C5074387
Malicious:	false
Preview:	LPKSHHRH..................\|xAgFY.q^...8..................................\|xAgFY.q^...8........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	43239
Entropy (8bit):	4.706866056888022
Encrypted:	false
SSDEEP:	768:EnwpzCEE33rA6r4rx2mRyax5x5I4/+CJ2r/Fi1Z:lpzCEE37AtRM4/+CJ2DFi1Z
MD5:	B6BB4F393CEC7BA53B09CA379E671A88
SHA1:	1888CFC595D1EA9C0F8BA8F7C281F06C4379CD1E
SHA-256:	6747302859CDAA496BAC01BCBEF1AD817077AD1FF88B746D8FDBB9271C7ADB47
SHA-512:	85362B5AB4461ADBF5690DBA519EA0E95E5914FBFC2FF549605DDD809D707302FD60DED4A2D20B898C63C93F4FDC529CF6B33FBB9E3802F19A40D77A06885433
Malicious:	false
Preview:	Jan 6 18:29:35 galassia kernel: [ 133.812122] blocking signal 19: 5570 -> 3157.Jan 6 18:29:35 galassia kernel: [ 133.973901] blocking signal 9: 5570 -> 661.Jan 6 18:29:35 galassia kernel: [ 133.982811] blocking signal 9: 5570 -> 725.Jan 6 18:29:35 galassia kernel: [ 133.991213] blocking signal 9: 5570 -> 767.Jan 6 18:29:35 galassia kernel: [ 133.999402] blocking signal 9: 5570 -> 769.Jan 6 18:29:35 galassia kernel: [ 134.007628] blocking signal 9: 5570 -> 780.Jan 6 18:29:35 galassia kernel: [ 134.016152] blocking signal 9: 5570 -> 940.Jan 6 18:29:35 galassia kernel: [ 134.025227] blocking signal 9: 5570 -> 1299.Jan 6 18:29:35 galassia kernel: [ 134.033578] blocking signal 9: 5570 -> 1300.Jan 6 18:29:35 galassia kernel: [ 134.043125] blocking signal 9: 5570 -> 2955.Jan 6 18:29:35 galassia kernel: [ 134.051202] blocking signal 9: 5570 -> 2956.Jan 6 18:29:35 galassia kernel: [ 134.059377] blocking signal 9: 5570 -> 3094.Jan 6 18:29:35 galassia kernel: [ 134.06763

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	158175
Entropy (8bit):	5.190796552676061
Encrypted:	false
SSDEEP:	1536:WE+SAT3B+HEL9+WCP3n/ZmARhK/+CJ22ob8gDl:WnSAb8lDjl
MD5:	A85CE0473732DDCDD66A39A00EAC939B
SHA1:	8B668D8AAB386DF63A8B7332AC478364AEEA089B
SHA-256:	534B025D82C76AD448BC5339193AD508B6D858628AE6CD77EEA28E7AC7DC55B5
SHA-512:	D4F4E13B75BB1A4599618D17D00FBF65C1422C88A797824B4A9FDEBA06E18FC87E63A34462ED0776D91A1508FBCE78B073942F79C97163CEA0B8529CACD22612
Malicious:	false
Preview:	Jan 6 18:29:35 galassia kernel: [ 133.812122] blocking signal 19: 5570 -> 3157.Jan 6 18:29:35 galassia kernel: [ 133.964826] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1..Jan 6 18:29:35 galassia kernel: [ 133.965274] systemd[1]: Stopping Flush Journal to Persistent Storage....Jan 6 18:29:35 galassia kernel: [ 133.973901] blocking signal 9: 5570 -> 661.Jan 6 18:29:35 galassia kernel: [ 133.982811] blocking signal 9: 5570 -> 725.Jan 6 18:29:35 galassia kernel: [ 133.991213] blocking signal 9: 5570 -> 767.Jan 6 18:29:35 galassia kernel: [ 133.999402] blocking signal 9: 5570 -> 769.Jan 6 18:29:35 galassia kernel: [ 134.007628] blocking signal 9: 5570 -> 780.Jan 6 18:29:35 galassia kernel: [ 134.016152] blocking signal 9: 5570 -> 940.Jan 6 18:29:35 galassia kernel: [ 134.025227] blocking signal 9: 5570 -> 1299.Jan 6 18:29:35 galassia kernel: [ 134.033578] blocking signal 9: 5570 -> 1300.Jan 6 18:29:35 galassia kernel: [ 134.043

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:cCsXlXEWtl/QJsIutl:cf+yloJAl
MD5:	F30FB660E78AE2AB9119BF52BD30EF6A
SHA1:	E8837DFF261910B1A65700C3D5C9384ACEA4C35B
SHA-256:	FAFB92F5DF6B6A782975FB2243602E99031AE9DC55C24F0C8A1D0B7AFB2E41FE
SHA-512:	C97D8ECC110A05EE2508167BC4AFE70B53C4213DC37BEEFE53B4D517416B30EF90DBE0D5E70891C8BC95E234477EB0221702A5BC1965F3DB96A2576AE30ADB71
Malicious:	true
Preview:	....=...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................=...su\|g.......................................

Source: fqkjei686.elf	ReversingLabs: Detection: 34%
Source: fqkjei686.elf	Virustotal: Detection: 28%			Perma Link

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.754922065347659
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	fqkjei686.elf
File size:	102'924 bytes
MD5:	235e7ef841686248d24647ff2b60afbd
SHA1:	bc2e031db47876843d8bd9907e10b6741edb0351
SHA256:	247e55175254ac760a09609f86bed47788907d50b5eac3d5905d6ae3b200f46d
SHA512:	7ffd32da39ab9f74f3cb383ff757b72028d0ea8fdccc13b7c12968ebc2499b3293a2f565238220ac2fd82a8fa94e0236e0bc1eec48f82a53687dbca31e898111
SSDEEP:	1536:AXIh4AIx9uB5OqmKuYBtMVdMLdWFcWJIQ+VHjwLNmKisjiIVWXgw:A4h4zxEO5KuYBt4MqGQ+VHELvVa
TLSH:	B7A34AC0F68BC0F5D45308705127B33FCB32EA255035DA2EEF6AAE2ADA63552931635D
File Content Preview:	.ELF....................h...4...\|.......4. ...(......................H...H...............H..........dG..4...........Q.td............................U..S.......SX...h....S!..[]...$.............U......=@ ...t..1...................u........t...$...........@

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	102524
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x12181	0x0	0x6	AX	16
.fini	PROGBITS	0x805a231	0x12231	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805a260	0x12260	0x2673	0x0	0x2	A	32
.ctors	PROGBITS	0x805d8d8	0x148d8	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805d8e4	0x148e4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805d900	0x14900	0x473c	0x0	0x3	WA	32
.bss	NOBITS	0x8062040	0x1903c	0x48cc	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1903c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x148d3	0x148d3	6.4873	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x148d8	0x805d8d8	0x805d8d8	0x4764	0x9034	0.3768	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 01:29:39.743484020 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable
Jan 7, 2025 01:30:59.760843992 CET	192.168.2.14	192.168.2.1	827a	(Port unreachable)	Destination Unreachable

Start time (UTC):	00:29:29
Start date (UTC):	07/01/2025
Path:	/tmp/fqkjei686.elf
Arguments:	/tmp/fqkjei686.elf
File size:	102924 bytes
MD5 hash:	235e7ef841686248d24647ff2b60afbd

Start time (UTC):	00:29:30
Start date (UTC):	07/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:29:32
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:33
Start date (UTC):	07/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:29:34
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:39
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:35
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:36
Start date (UTC):	07/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:29:37
Start date (UTC):	07/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:29:38
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:49
Start date (UTC):	07/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:29:50
Start date (UTC):	07/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:29:51
Start date (UTC):	07/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:29:53
Start date (UTC):	07/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fqkjei686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5822/oom_score_adj

/proc/5825/oom_score_adj

/proc/5827/oom_score_adj

/proc/5829/oom_score_adj

/proc/5831/oom_score_adj

/proc/5833/oom_score_adj

/proc/5836/oom_score_adj

/proc/5882/oom_score_adj

/proc/5909/oom_score_adj

/proc/5912/oom_score_adj

/proc/5914/oom_score_adj

/proc/5916/oom_score_adj

/proc/5918/oom_score_adj

/proc/5920/oom_score_adj

/proc/5923/oom_score_adj

/proc/6088/oom_score_adj

/proc/6251/oom_score_adj

/proc/6267/oom_score_adj

/proc/6323/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1r8BCzS

/run/systemd/inhibit/.#2fFNBkW

/run/systemd/inhibit/.#3lOxtTR

/run/systemd/inhibit/.#4pswHUU

/run/systemd/inhibit/.#5YPu17U

/run/systemd/journal/streams/.#9:68463eH3ev2

Linux Analysis Report
fqkjei686.elf

Start time (UTC):	00:29:54
Start date (UTC):	07/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	00:29:55
Start date (UTC):	07/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	00:29:56
Start date (UTC):	07/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	00:29:58
Start date (UTC):	07/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:30:00
Start date (UTC):	07/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	00:30:06
Start date (UTC):	07/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	00:30:25
Start date (UTC):	07/01/2025
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	00:30:10
Start date (UTC):	07/01/2025
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	00:30:14
Start date (UTC):	07/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	00:30:28
Start date (UTC):	07/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c