534500x800000000000000015162Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.038{6cc3031b-2f1e-6ad6-bd66-acbdfa5b0000}3813/usr/lib/cargo/bin/coreutils/chmodroot 534500x800000000000000015165Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.095{6cc3031b-2f1e-6ad6-bd86-1843485c0000}3831/usr/lib/cargo/bin/coreutils/catroot 534500x800000000000000015167Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.084{6cc3031b-2f1e-6ad6-bde6-ad3b92620000}3826/usr/lib/cargo/bin/coreutils/catroot 534500x800000000000000015169Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.108{6cc3031b-2f1e-6ad6-bd36-f20eb7620000}3832/usr/lib/cargo/bin/coreutils/catroot 534500x800000000000000015173Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.337{00000000-0000-0000-0000-000000000000}3851<unknown process>root 534500x800000000000000015172Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.326{00000000-0000-0000-0000-000000000000}3846<unknown process>root 534500x800000000000000015171Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.295{00000000-0000-0000-0000-000000000000}3842<unknown process>root 534500x800000000000000015184Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.252{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838/usr/bin/sysmonroot 11241100x800000000000000015183Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838/usr/bin/sysmon/opt/sysmon/argv2026-10-19 14:54:22.250- 23542300x800000000000000015182Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838-/usr/bin/sysmon/opt/sysmon/argv--- 11241100x800000000000000015181Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838/usr/bin/sysmon/opt/sysmon/argc2026-10-19 14:54:22.250- 23542300x800000000000000015180Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838-/usr/bin/sysmon/opt/sysmon/argc--- 11241100x800000000000000015179Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838/usr/bin/sysmon/opt/sysmon/config.xml2026-10-19 14:54:22.250- 23542300x800000000000000015178Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.250{6cc3031b-2f1e-6ad6-411d-7f644f5b0000}3838-/usr/bin/sysmon/opt/sysmon/config.xml--- 534500x800000000000000015186Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.146{6cc3031b-2f1e-6ad6-bd56-bed49d620000}3835/usr/lib/cargo/bin/coreutils/catroot 534500x800000000000000015189Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.181{6cc3031b-2f1e-6ad6-410d-4209705f0000}3836/usr/bin/sysmon- 534500x800000000000000015190Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.292{00000000-0000-0000-0000-000000000000}3839<unknown process>- 23542300x800000000000000015193Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.932{6cc3031b-2eb5-6ad6-f942-ef42df620000}482-/usr/bin/udevadm/run/udev/queue--- 23542300x800000000000000015192Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.918{6cc3031b-2eb5-6ad6-f942-ef42df620000}482-/usr/bin/udevadm/run/udev/queue--- 534500x800000000000000015196Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.328{00000000-0000-0000-0000-000000000000}3848<unknown process>root 534500x800000000000000015195Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.296{00000000-0000-0000-0000-000000000000}3843<unknown process>root 534500x800000000000000015194Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.293{00000000-0000-0000-0000-000000000000}3840<unknown process>root 534500x800000000000000015202Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.295{00000000-0000-0000-0000-000000000000}3841<unknown process>- 534500x800000000000000015201Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.928{6cc3031b-2f1e-6ad6-81a6-486f35630000}3894/usr/bin/dumpcaproot 534500x800000000000000015205Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.329{00000000-0000-0000-0000-000000000000}3850<unknown process>- 534500x800000000000000015204Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.329{00000000-0000-0000-0000-000000000000}3849<unknown process>- 534500x800000000000000015203Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.326{00000000-0000-0000-0000-000000000000}3847<unknown process>- 534500x800000000000000015210Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.905{00000000-0000-0000-0000-000000000000}3896<unknown process>root 534500x800000000000000015209Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.900{00000000-0000-0000-0000-000000000000}3895<unknown process>root 534500x800000000000000015211Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:22.928{00000000-0000-0000-0000-000000000000}3897<unknown process>root 154100x800000000000000015215Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.115{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poc-----./poc/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=4c6f78ffa36adbf111b38b3f12c262fb,SHA256=fc5e02cb2d5330f2659a92c4d8695b1030f864c0a5271e6a56c00f74d65673fc{6cc3031b-2f0f-6ad6-a1f9-1dc6f5550000}3786/usr/bin/bash/usr/bin/bashlocaluser 534500x800000000000000015214Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.114{6cc3031b-2f21-6ad6-bd96-5b9441650000}3944/usr/lib/cargo/bin/coreutils/unamelocaluser 154100x800000000000000015213Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.111{6cc3031b-2f21-6ad6-bd96-5b9441650000}3944/usr/lib/cargo/bin/coreutils/uname-----uname -r/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=2d313ecc9fc058f6e0758abe00c0f6e8,SHA256=48893b0fb21436b54619db80486e83ef39dfccaf1aefe83dfa00c02d6146e8c0{6cc3031b-2f0f-6ad6-a1f9-1dc6f5550000}3786/usr/bin/bash/usr/bin/bashlocaluser 23542300x800000000000000015216Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.183{6cc3031b-2eb5-6ad6-f942-ef42df620000}482-/usr/bin/udevadm/run/udev/queue--- 534500x800000000000000015217Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.187{6cc3031b-2f21-6ad6-0000-000000000000}3949<unknown process>root 23542300x800000000000000015218Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.190{6cc3031b-2eb5-6ad6-f942-ef42df620000}482-/usr/bin/udevadm/run/udev/queue--- 154100x800000000000000015219Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.800{6cc3031b-2f21-6ad6-ad6e-a47a325a0000}3953/usr/bin/dash-----sh -c -- gcc /tmp/priv_escalation.c -o /tmp/pwn/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=c9f2b666550e3e64b27d033b4bd86751,SHA256=c626229526bb58ec2d0f585f3c3ae1412e6f973b4353385042d11c38d8426917{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poc./poclocaluser 154100x800000000000000015220Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.801{6cc3031b-2f21-6ad6-b1f3-470000000000}3954/usr/bin/x86_64-linux-gnu-gcc-15-----gcc /tmp/priv_escalation.c -o /tmp/pwn/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=34d4f49b80762b709e7efeec75ff1fca,SHA256=b5f1b773a7c733738352000c92a077dc5852a1a2fc6d836b1e411be1e9ec5f88{6cc3031b-2f21-6ad6-ad6e-a47a325a0000}3953/usr/bin/dashshlocaluser 534500x800000000000000015222Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.847{6cc3031b-2f21-6ad6-1dcf-dd0100000000}3955/usr/libexec/gcc/x86_64-linux-gnu/15/cc1localuser 154100x800000000000000015221Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.805{6cc3031b-2f21-6ad6-1dcf-dd0100000000}3955/usr/libexec/gcc/x86_64-linux-gnu/15/cc1-----/usr/libexec/gcc/x86_64-linux-gnu/15/cc1 -quiet -imultiarch x86_64-linux-gnu /tmp/priv_escalation.c -quiet -dumpdir /tmp/pwn- -dumpbase priv_escalation.c -dumpbase-ext .c -mtune=generic -march=x86-64 -fasynchronous-unwind-tables -fstack-protector-strong -Wformat -Wformat-security -fstack-clash-protection -fcf-protection -fzero-init-padding-bits=all -Wbidi-chars=any -o /tmp/ccM9vll0.s/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=9331b8b140a60b873be39f0152aac0e4,SHA256=30510b346885152c4fce41d2b501751c95d3690b1c34eaa04ebb970e70eae620{6cc3031b-2f21-6ad6-b1f3-470000000000}3954/usr/bin/x86_64-linux-gnu-gcc-15gcclocaluser 534500x800000000000000015224Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.855{6cc3031b-2f21-6ad6-2d06-56d9b35f0000}3956/usr/bin/x86_64-linux-gnu-aslocaluser 154100x800000000000000015223Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.848{6cc3031b-2f21-6ad6-2d06-56d9b35f0000}3956/usr/bin/x86_64-linux-gnu-as-----/usr/bin/x86_64-linux-gnu-as --64 -o /tmp/ccNIudGY.o /tmp/ccM9vll0.s/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=939d8366f2ca1272f2af3f24ce67ef26,SHA256=4e5fcaa3cdc160173cb5cfe7aa35dc39d7aa1f06ba8d75b8d923bbae5473991b{6cc3031b-2f21-6ad6-b1f3-470000000000}3954/usr/bin/x86_64-linux-gnu-gcc-15gcclocaluser 534500x800000000000000015226Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.883{6cc3031b-2f21-6ad6-bd1b-2c97185b0000}3958/usr/bin/x86_64-linux-gnu-ld.bfdlocaluser 154100x800000000000000015225Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.859{6cc3031b-2f21-6ad6-bd1b-2c97185b0000}3958/usr/bin/x86_64-linux-gnu-ld.bfd-----/usr/bin/ld -plugin /usr/libexec/gcc/x86_64-linux-gnu/15/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/15/lto-wrapper -plugin-opt=-fresolution=/tmp/ccrn5H7Z.res -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /tmp/pwn /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/15/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/15 -L/usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/15/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/15/../../.. -L/lib -L/usr/lib /tmp/ccNIudGY.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/15/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/crtn.o/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=10a0f56da85eafd844fd038d04e2493c,SHA256=97f48d93b8b076a92d2809ec29dcb17f0f37c8827358f832255e2ed22fef6075{00000000-0000-0000-0000-000000000000}3957--- 534500x800000000000000015235Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.885{00000000-0000-0000-0000-000000000000}3959<unknown process>root 534500x800000000000000015234Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-b1f3-470000000000}3954/usr/bin/x86_64-linux-gnu-gcc-15localuser 23542300x800000000000000015233Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-b1f3-470000000000}3954localuser/usr/bin/x86_64-linux-gnu-gcc-15/tmp/ccM9vll0.s--- 23542300x800000000000000015232Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-b1f3-470000000000}3954localuser/usr/bin/x86_64-linux-gnu-gcc-15/tmp/ccNIudGY.o--- 23542300x800000000000000015231Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-b1f3-470000000000}3954localuser/usr/bin/x86_64-linux-gnu-gcc-15/tmp/ccrn5H7Z.res--- 534500x800000000000000015230Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-3166-450000000000}3957/usr/libexec/gcc/x86_64-linux-gnu/15/collect2localuser 23542300x800000000000000015229Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-3166-450000000000}3957localuser/usr/libexec/gcc/x86_64-linux-gnu/15/collect2/tmp/ccqFl1WL.cdtor.o--- 23542300x800000000000000015228Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-3166-450000000000}3957localuser/usr/libexec/gcc/x86_64-linux-gnu/15/collect2/tmp/cc8NFrrl.cdtor.c--- 154100x800000000000000015227Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.855{6cc3031b-2f21-6ad6-3166-450000000000}3957/usr/libexec/gcc/x86_64-linux-gnu/15/collect2-----/usr/libexec/gcc/x86_64-linux-gnu/15/collect2 -plugin /usr/libexec/gcc/x86_64-linux-gnu/15/liblto_plugin.so -plugin-opt=/usr/libexec/gcc/x86_64-linux-gnu/15/lto-wrapper -plugin-opt=-fresolution=/tmp/ccrn5H7Z.res -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /tmp/pwn /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/15/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/15 -L/usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/15/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/15/../../.. -L/lib -L/usr/lib /tmp/ccNIudGY.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/15/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/crtn.o/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=71fe2a7b7acee8850f70147b4b316f67,SHA256=8ab5d946ba2c948e5ea5c91e25a104439302e0599a521785770d10690c565437{6cc3031b-2f21-6ad6-b1f3-470000000000}3954/usr/bin/x86_64-linux-gnu-gcc-15gcclocaluser 534500x800000000000000015236Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.884{6cc3031b-2f21-6ad6-ad6e-a47a325a0000}3953/usr/bin/dashlocaluser 534500x800000000000000015239Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:26.864{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poclocaluser 534500x800000000000000015238Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:26.864{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poclocaluser 534500x800000000000000015237Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:26.864{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poclocaluser 534500x800000000000000015241Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:26.868{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poclocaluser 534500x800000000000000015240Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:26.868{6cc3031b-2f21-6ad6-3dd5-0202ed5e0000}3945/home/localuser/CVE-2026-74580-main/poclocaluser 154100x800000000000000015242Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:25.115{6cc3031b-2f21-6ad6-adbe-a4d609610000}3945/tmp/sh-----/tmp/sh -p/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=c9f2b666550e3e64b27d033b4bd86751,SHA256=c626229526bb58ec2d0f585f3c3ae1412e6f973b4353385042d11c38d8426917{6cc3031b-2f0f-6ad6-a1f9-1dc6f5550000}3786/usr/bin/bash/usr/bin/bashlocaluser 534500x800000000000000015243Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:27.416{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015244Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:27.983{6cc3031b-2eba-6ad6-798f-81c2d95d0000}1973gnome-shelllocaluser 534500x800000000000000015247Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:28.493{00000000-0000-0000-0000-000000000000}3899<unknown process>root 534500x800000000000000015246Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:28.493{00000000-0000-0000-0000-000000000000}3898<unknown process>root 534500x800000000000000015245Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:28.493{6cc3031b-2f1e-6ad6-0000-000000000000}3900<unknown process>root 534500x800000000000000015248Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:28.493{00000000-0000-0000-0000-000000000000}3905<unknown process>root 534500x800000000000000015249Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:28.672{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726pwsh- 354300x800000000000000015250Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:29.658{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726pwshlocaluserudpfalsefalse127.0.0.53-53-false127.0.0.1-49157- 354300x800000000000000015251Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:29.780{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726/snap/powershell/414/opt/powershell/pwshroottcptruetrue0:0:0:0:0:ffff:a03:af9-54468-true0:0:0:0:0:ffff:34bc:f795-443- 534500x800000000000000015253Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:33.570{6cc3031b-2f29-6ad6-bd76-5048bb630000}3964/usr/lib/cargo/bin/coreutils/whoamilocaluser 154100x800000000000000015252Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:33.567{6cc3031b-2f29-6ad6-bd76-5048bb630000}3964/usr/lib/cargo/bin/coreutils/whoami-----whoami/home/localuser/CVE-2026-74580-mainlocaluser{6cc3031b-0000-0000-e803-000002000000}10002no levelMD5=2d313ecc9fc058f6e0758abe00c0f6e8,SHA256=48893b0fb21436b54619db80486e83ef39dfccaf1aefe83dfa00c02d6146e8c0{6cc3031b-2f21-6ad6-adbe-a4d609610000}3945/tmp/sh/tmp/shlocaluser 534500x800000000000000015254Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:34.523{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015255Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:36.644{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816pwshroot 534500x800000000000000015261Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166-localuser 534500x800000000000000015260Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166-localuser 534500x800000000000000015259Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166-localuser 534500x800000000000000015258Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166-localuser 534500x800000000000000015257Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166-localuser 534500x800000000000000015256Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.485{6cc3031b-2ef1-6ad6-0000-000000000000}3166<unknown process>localuser 534500x800000000000000015265Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.487{00000000-0000-0000-0000-000000000000}3966<unknown process>root 534500x800000000000000015264Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.487{6cc3031b-2f2d-6ad6-0000-000000000000}3968<unknown process>root 23542300x800000000000000015263Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.486{6cc3031b-2eb5-6ad6-f131-9500d15b0000}432-/usr/lib/systemd/systemd-journald/run/systemd/journal/streams/10:27934--- 23542300x800000000000000015262Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:37.486{6cc3031b-2eb5-6ad6-f131-9500d15b0000}432-/usr/lib/systemd/systemd-journald/run/systemd/journal/streams/10:27935--- 534500x800000000000000015266Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:40.625{6cc3031b-2eba-6ad6-c166-ba92355d0000}1961gnome-session-servicelocaluser 534500x800000000000000015267Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.364{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726pwshroot 534500x800000000000000015270Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.371{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015269Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.371{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015268Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.371{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816pwshroot 534500x800000000000000015271Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.373{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015274Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.597{6cc3031b-2f1e-6ad6-f05a-9490e65a0000}3868/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015273Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.597{6cc3031b-2f1e-6ad6-f05a-9490e65a0000}3868/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015272Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.597{6cc3031b-2f1e-6ad6-f05a-9490e65a0000}3868/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015275Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.599{6cc3031b-2f1e-6ad6-f05a-9490e65a0000}3868/snap/powershell/414/opt/powershell/pwshroot 534500x800000000000000015276Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:42.863{6cc3031b-2ebc-6ad6-b55b-c25fec570000}2486xdg-desktop-portallocaluser 534500x800000000000000015277Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:43.580{6cc3031b-2f05-6ad6-f08a-aefd69580000}3726pwshroot 534500x800000000000000015278Linux-Sysmon/Operationalunbutu-2026-10-19 14:54:46.571{6cc3031b-2f1e-6ad6-f0ea-9ca7d05c0000}3816pwshroot