Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527305
MD5:	cec8e5b6a9341c75d85623039d061000
SHA1:	d21caee1c8c53559cc4d810e7e56b0bce4a883e5
SHA256:	9b77d6b60b0b175dd125e11b95dac1fde38deaba01c75c544fa3b5d44bc7d93a
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Contains symbols with names commonly found in malware

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527305
Start date and time:	2024-10-06 22:27:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/96@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5523, Parent: 5448, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5525, Parent: 5523)

na.elf New Fork (PID: 5526, Parent: 5523)

na.elf New Fork (PID: 5529, Parent: 5523)

na.elf New Fork (PID: 5531, Parent: 5529)

na.elf New Fork (PID: 5532, Parent: 5529)

na.elf New Fork (PID: 5535, Parent: 5529)

na.elf New Fork (PID: 5537, Parent: 5529)

na.elf New Fork (PID: 5538, Parent: 5529)

systemd New Fork (PID: 5573, Parent: 1)

dbus-daemon (PID: 5573, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5574, Parent: 1)

rsyslogd (PID: 5574, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5575, Parent: 3044)

pulseaudio (PID: 5575, Parent: 3044, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 5578, Parent: 3210)

fusermount (PID: 5578, Parent: 3210, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5588, Parent: 1)

rtkit-daemon (PID: 5588, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5591, Parent: 1)

systemd-logind (PID: 5591, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5650, Parent: 1)

polkitd (PID: 5650, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5654, Parent: 1)

agetty (PID: 5654, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 5655, Parent: 1333)

Default (PID: 5655, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5656, Parent: 1333)

Default (PID: 5656, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5657, Parent: 1333)

Default (PID: 5657, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5660, Parent: 1)

gpu-manager (PID: 5660, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5661, Parent: 5660)

sh (PID: 5661, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5662, Parent: 5661)

grep (PID: 5662, Parent: 5661, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5664, Parent: 5660)

sh (PID: 5664, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5665, Parent: 5664)

grep (PID: 5665, Parent: 5664, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5666, Parent: 5660)

sh (PID: 5666, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5667, Parent: 5666)

grep (PID: 5667, Parent: 5666, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5668, Parent: 5660)

sh (PID: 5668, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5669, Parent: 5668)

grep (PID: 5669, Parent: 5668, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5671, Parent: 5660)

sh (PID: 5671, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5672, Parent: 5671)

grep (PID: 5672, Parent: 5671, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5674, Parent: 5660)

sh (PID: 5674, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5675, Parent: 5674)

grep (PID: 5675, Parent: 5674, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5676, Parent: 5660)

sh (PID: 5676, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5677, Parent: 5676)

grep (PID: 5677, Parent: 5676, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5678, Parent: 5660)

sh (PID: 5678, Parent: 5660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5679, Parent: 5678)

grep (PID: 5679, Parent: 5678, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5673, Parent: 3044)

dbus-daemon (PID: 5673, Parent: 3044, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5680, Parent: 1)

generate-config (PID: 5680, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5681, Parent: 5680)

pkill (PID: 5681, Parent: 5680, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5684, Parent: 1)

gdm-wait-for-drm (PID: 5684, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5689, Parent: 1)

gdm3 (PID: 5689, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5693, Parent: 5689)

plymouth (PID: 5693, Parent: 5689, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5711, Parent: 5689)

gdm-session-worker (PID: 5711, Parent: 5689, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5717, Parent: 5711)

gdm-wayland-session (PID: 5717, Parent: 5711, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5721, Parent: 5717)

dbus-run-session (PID: 5721, Parent: 5717, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5722, Parent: 5721)

dbus-daemon (PID: 5722, Parent: 5721, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5726, Parent: 5722)

dbus-daemon New Fork (PID: 5727, Parent: 5726)

false (PID: 5727, Parent: 5726, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5729, Parent: 5722)

dbus-daemon New Fork (PID: 5730, Parent: 5729)

false (PID: 5730, Parent: 5729, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5731, Parent: 5722)

dbus-daemon New Fork (PID: 5732, Parent: 5731)

false (PID: 5732, Parent: 5731, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5733, Parent: 5722)

dbus-daemon New Fork (PID: 5734, Parent: 5733)

false (PID: 5734, Parent: 5733, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5735, Parent: 5722)

dbus-daemon New Fork (PID: 5736, Parent: 5735)

false (PID: 5736, Parent: 5735, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5737, Parent: 5722)

dbus-daemon New Fork (PID: 5738, Parent: 5737)

false (PID: 5738, Parent: 5737, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5740, Parent: 5722)

dbus-daemon New Fork (PID: 5741, Parent: 5740)

false (PID: 5741, Parent: 5740, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5723, Parent: 5721)

gnome-session (PID: 5723, Parent: 5721, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5723, Parent: 5721, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5742, Parent: 5723)

session-migration (PID: 5742, Parent: 5723, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5743, Parent: 5723)

sh (PID: 5743, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5743, Parent: 5723, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5770, Parent: 5689)

gdm-session-worker (PID: 5770, Parent: 5689, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5777, Parent: 5770)

gdm-x-session (PID: 5777, Parent: 5770, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5779, Parent: 5777)

Xorg (PID: 5779, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5779, Parent: 5777, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5779, Parent: 5777, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5790, Parent: 5779)

sh (PID: 5790, Parent: 5779, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5791, Parent: 5790)

xkbcomp (PID: 5791, Parent: 5790, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 6037, Parent: 5779)

sh (PID: 6037, Parent: 5779, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 6040, Parent: 6037)

xkbcomp (PID: 6040, Parent: 6037, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5796, Parent: 5777)

Default (PID: 5796, Parent: 5777, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5797, Parent: 5777)

dbus-run-session (PID: 5797, Parent: 5777, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5798, Parent: 5797)

dbus-daemon (PID: 5798, Parent: 5797, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5812, Parent: 5798)

dbus-daemon New Fork (PID: 5813, Parent: 5812)

at-spi-bus-launcher (PID: 5813, Parent: 5812, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5818, Parent: 5813)

dbus-daemon (PID: 5818, Parent: 5813, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6196, Parent: 5818)

dbus-daemon New Fork (PID: 6197, Parent: 6196)

at-spi2-registryd (PID: 6197, Parent: 6196, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5842, Parent: 5798)

dbus-daemon New Fork (PID: 5843, Parent: 5842)

false (PID: 5843, Parent: 5842, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5845, Parent: 5798)

dbus-daemon New Fork (PID: 5846, Parent: 5845)

false (PID: 5846, Parent: 5845, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5847, Parent: 5798)

dbus-daemon New Fork (PID: 5848, Parent: 5847)

false (PID: 5848, Parent: 5847, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5849, Parent: 5798)

dbus-daemon New Fork (PID: 5850, Parent: 5849)

false (PID: 5850, Parent: 5849, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5851, Parent: 5798)

dbus-daemon New Fork (PID: 5852, Parent: 5851)

false (PID: 5852, Parent: 5851, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5853, Parent: 5798)

dbus-daemon New Fork (PID: 5854, Parent: 5853)

false (PID: 5854, Parent: 5853, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5856, Parent: 5798)

dbus-daemon New Fork (PID: 5857, Parent: 5856)

false (PID: 5857, Parent: 5856, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 6038, Parent: 5798)

dbus-daemon New Fork (PID: 6039, Parent: 6038)

ibus-portal (PID: 6039, Parent: 6038, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6213, Parent: 5798)

dbus-daemon New Fork (PID: 6214, Parent: 6213)

gjs (PID: 6214, Parent: 6213, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6437, Parent: 5798)

dbus-daemon New Fork (PID: 6438, Parent: 6437)

false (PID: 6438, Parent: 6437, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5799, Parent: 5797)

gnome-session (PID: 5799, Parent: 5797, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5799, Parent: 5797, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5800, Parent: 5799)

gnome-session-check-accelerated (PID: 5800, Parent: 5799, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5819, Parent: 5800)

gnome-session-check-accelerated-gl-helper (PID: 5819, Parent: 5800, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5829, Parent: 5800)

gnome-session-check-accelerated-gles-helper (PID: 5829, Parent: 5800, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5858, Parent: 5799)

session-migration (PID: 5858, Parent: 5799, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5859, Parent: 5799)

sh (PID: 5859, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5859, Parent: 5799, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 6001, Parent: 5859)

ibus-daemon (PID: 6001, Parent: 5859, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 6033, Parent: 6001)

ibus-memconf (PID: 6033, Parent: 6001, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 6035, Parent: 6001)

ibus-daemon New Fork (PID: 6036, Parent: 6035)

ibus-x11 (PID: 6036, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6248, Parent: 6001)

ibus-engine-simple (PID: 6248, Parent: 6001, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6229, Parent: 5799)

sh (PID: 6229, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6229, Parent: 5799, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6231, Parent: 5799)

sh (PID: 6231, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6231, Parent: 5799, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6233, Parent: 5799)

sh (PID: 6233, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6233, Parent: 5799, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6234, Parent: 5799)

sh (PID: 6234, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6234, Parent: 5799, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6235, Parent: 5799)

sh (PID: 6235, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6235, Parent: 5799, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6274, Parent: 6235)

gsd-print-notifications New Fork (PID: 6276, Parent: 6274)

gsd-printer (PID: 6276, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6236, Parent: 5799)

sh (PID: 6236, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6236, Parent: 5799, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6238, Parent: 5799)

sh (PID: 6238, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6238, Parent: 5799, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6241, Parent: 5799)

sh (PID: 6241, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6241, Parent: 5799, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6244, Parent: 5799)

sh (PID: 6244, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6244, Parent: 5799, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6245, Parent: 5799)

sh (PID: 6245, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6245, Parent: 5799, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6247, Parent: 5799)

sh (PID: 6247, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6247, Parent: 5799, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6251, Parent: 5799)

sh (PID: 6251, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6251, Parent: 5799, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6253, Parent: 5799)

sh (PID: 6253, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6253, Parent: 5799, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6257, Parent: 5799)

sh (PID: 6257, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6257, Parent: 5799, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6686, Parent: 5799)

sh (PID: 6686, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6686, Parent: 5799, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6817, Parent: 5799)

sh (PID: 6817, Parent: 5799, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6817, Parent: 5799, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5771, Parent: 5689)

Default (PID: 5771, Parent: 5689, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5772, Parent: 5689)

Default (PID: 5772, Parent: 5689, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5695, Parent: 1)

accounts-daemon (PID: 5695, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5706, Parent: 5695)

language-validate (PID: 5706, Parent: 5695, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5707, Parent: 5706)

language-options (PID: 5707, Parent: 5706, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5708, Parent: 5707)

sh (PID: 5708, Parent: 5707, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5709, Parent: 5708)

locale (PID: 5709, Parent: 5708, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5710, Parent: 5708)

grep (PID: 5710, Parent: 5708, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5719, Parent: 1431)

dbus-daemon (PID: 5719, Parent: 1431, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5884, Parent: 1)

systemd-localed (PID: 5884, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6046, Parent: 1)

upowerd (PID: 6046, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6084, Parent: 1431)

pulseaudio (PID: 6084, Parent: 1431, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6089, Parent: 1)

geoclue (PID: 6089, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6202, Parent: 1)

wpa_supplicant (PID: 6202, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6206, Parent: 1)

avahi-daemon (PID: 6206, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6209, Parent: 6206)

systemd New Fork (PID: 6211, Parent: 1)

packagekitd (PID: 6211, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6228, Parent: 6211)

dpkg (PID: 6228, Parent: 6211, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6277, Parent: 1)

systemd-hostnamed (PID: 6277, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6463, Parent: 1)

ModemManager (PID: 6463, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6521, Parent: 1)

colord (PID: 6521, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6687, Parent: 6521)

colord-sane (PID: 6687, Parent: 6521, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6522, Parent: 1)

systemd-localed (PID: 6522, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6693, Parent: 1)

fprintd (PID: 6693, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5523	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5523	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5525	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5525	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5526	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5526	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5529	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5529	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5531	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5531	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5532	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5532	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 19 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.15:35718 -> 154.216.20.119:777

Source: /usr/sbin/rsyslogd (PID: 5574)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5689)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5722)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5723)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5779)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5798)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5818)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5799)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 6001)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 70.101.226.35
Source: unknown	TCP traffic detected without corresponding DNS query: 152.44.31.34
Source: unknown	TCP traffic detected without corresponding DNS query: 5.235.28.64
Source: unknown	TCP traffic detected without corresponding DNS query: 153.50.175.47
Source: unknown	TCP traffic detected without corresponding DNS query: 172.73.184.148
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.139.214
Source: unknown	TCP traffic detected without corresponding DNS query: 83.150.136.75
Source: unknown	TCP traffic detected without corresponding DNS query: 133.49.128.190
Source: unknown	TCP traffic detected without corresponding DNS query: 142.118.195.134
Source: unknown	TCP traffic detected without corresponding DNS query: 36.50.95.246
Source: unknown	TCP traffic detected without corresponding DNS query: 19.109.223.80
Source: unknown	TCP traffic detected without corresponding DNS query: 65.244.28.158
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.203.185
Source: unknown	TCP traffic detected without corresponding DNS query: 140.141.123.184
Source: unknown	TCP traffic detected without corresponding DNS query: 206.220.8.214
Source: unknown	TCP traffic detected without corresponding DNS query: 142.161.68.194
Source: unknown	TCP traffic detected without corresponding DNS query: 134.164.177.250
Source: unknown	TCP traffic detected without corresponding DNS query: 133.228.237.118
Source: unknown	TCP traffic detected without corresponding DNS query: 153.118.136.20
Source: unknown	TCP traffic detected without corresponding DNS query: 138.223.165.195
Source: unknown	TCP traffic detected without corresponding DNS query: 138.161.231.143
Source: unknown	TCP traffic detected without corresponding DNS query: 52.192.50.122
Source: unknown	TCP traffic detected without corresponding DNS query: 122.128.226.26
Source: unknown	TCP traffic detected without corresponding DNS query: 58.177.93.90
Source: unknown	TCP traffic detected without corresponding DNS query: 94.109.15.166
Source: unknown	TCP traffic detected without corresponding DNS query: 216.36.80.20
Source: unknown	TCP traffic detected without corresponding DNS query: 182.141.97.207
Source: unknown	TCP traffic detected without corresponding DNS query: 107.94.99.9
Source: unknown	TCP traffic detected without corresponding DNS query: 58.70.85.52
Source: unknown	TCP traffic detected without corresponding DNS query: 62.92.19.101
Source: unknown	TCP traffic detected without corresponding DNS query: 24.254.59.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.213.39.71
Source: unknown	TCP traffic detected without corresponding DNS query: 70.247.84.72
Source: unknown	TCP traffic detected without corresponding DNS query: 126.254.94.222
Source: unknown	TCP traffic detected without corresponding DNS query: 129.22.171.1
Source: unknown	TCP traffic detected without corresponding DNS query: 75.20.205.16
Source: unknown	TCP traffic detected without corresponding DNS query: 125.14.87.246
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.113.147
Source: unknown	TCP traffic detected without corresponding DNS query: 132.119.61.159
Source: unknown	TCP traffic detected without corresponding DNS query: 212.6.88.82
Source: unknown	TCP traffic detected without corresponding DNS query: 88.188.227.74
Source: unknown	TCP traffic detected without corresponding DNS query: 180.50.92.144
Source: unknown	TCP traffic detected without corresponding DNS query: 109.238.20.5
Source: unknown	TCP traffic detected without corresponding DNS query: 182.190.17.55
Source: unknown	TCP traffic detected without corresponding DNS query: 122.231.31.186
Source: unknown	TCP traffic detected without corresponding DNS query: 169.117.23.238
Source: unknown	TCP traffic detected without corresponding DNS query: 31.216.88.156
Source: unknown	TCP traffic detected without corresponding DNS query: 36.202.16.185
Source: unknown	TCP traffic detected without corresponding DNS query: 31.48.130.55
Source: unknown	TCP traffic detected without corresponding DNS query: 204.169.133.187

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: Xorg.0.log.151.dr, syslog.24.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.151.dr, syslog.24.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.24.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 724, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 782, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 789, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 796, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent to PID below 1000: pid: 933, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent to PID below 1000: pid: 933, result: successful	Jump to behavior

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_greeth
Source: ELF static info symbol of initial sample	Name: attack_method_greip
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_tcpack

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1440, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 2527, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3060, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3798, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3799, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3800, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5525, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 2527, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3798, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3799, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3800, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5529, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5531, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 5812, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6038, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6213, result: successful
Source: /usr/bin/dbus-daemon (PID: 5818)	SIGKILL sent: pid: 6196, result: successful

Source: na.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 724, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1440, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 2527, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3060, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3798, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3799, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 3800, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5525)	SIGKILL sent: pid: 5525, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 133, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 681, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 723, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1185, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1333, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 2527, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3797, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3798, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3799, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 3800, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5529, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5531)	SIGKILL sent: pid: 5531, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 5812, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6038, result: successful
Source: /usr/bin/dbus-daemon (PID: 5798)	SIGKILL sent: pid: 6213, result: successful
Source: /usr/bin/dbus-daemon (PID: 5818)	SIGKILL sent: pid: 6196, result: successful

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/96@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5573)	File: /proc/5573/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5578)	File: /proc/5578/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5673)	File: /proc/5673/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5722)	File: /proc/5722/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5798)	File: /proc/5798/mounts
Source: /usr/bin/dbus-daemon (PID: 5818)	File: /proc/5818/mounts
Source: /usr/bin/gjs (PID: 6214)	File: /proc/6214/mounts
Source: /usr/bin/gnome-shell (PID: 5859)	File: /proc/5859/mounts
Source: /usr/bin/dbus-daemon (PID: 5719)	File: /proc/5719/mounts

Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0Ks2yQW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127OC9QJX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#1275qdhNY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0dYsvIV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127GD0xd0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1LUhZRY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127r9CKxX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0j1ePNZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127hNF3sX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1Uw5HkZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1AwLwTY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#1278sL5FV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1VOXiTX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1K3B0AZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c1DMnAzY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127tJLF7Y	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0JQh1IV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127nCmhuY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0yXtEjY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127v5ggYV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0Oks08X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127mylJRV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2yu52CZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127VWIOlW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/seats/.#seat0HA3C8W	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2U3kGSZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2aKJAZV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/users/.#127nr3BJZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2YQNfa0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c25WN7tX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2XkJsNW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2blc1TW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/sessions/.#c2yKAIsX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/inhibit/.#1jCgqqW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/inhibit/.#2JzQzWZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/inhibit/.#3XO2naW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File: /run/systemd/inhibit/.#4wOMjRX	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5650)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5743)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5743)	Directory: <invalid fd (10)>/..
Source: /usr/lib/xorg/Xorg (PID: 5779)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5779)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5800)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5800)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5800)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5819)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5829)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5829)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5829)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5859)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 6036)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 6036)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6231)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6231)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6233)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6233)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6234)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6234)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6236)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6236)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6257)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6257)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5695)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5695)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 6046)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 6046)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6211)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6277)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6463)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6463)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6521)	Directory: /var/lib/colord/.cache

Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5770/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5770/sessionid	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/6257/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/6257/stat	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/environ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/sched	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/1/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5711/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5711/sessionid	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5779/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5859/cgroup	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5591)	File opened: /proc/5859/stat	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/911/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/911/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/914/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/914/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/7/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/7/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/129/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/129/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/8/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	File opened: /proc/8/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5661)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5664)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5666)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5668)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5671)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5674)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5676)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5678)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5790)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 6037)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5708)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5662)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5665)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5667)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5669)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5672)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5675)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5677)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5679)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5710)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5681)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5654)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5689)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5689)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5695)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5695)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5574)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5574)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5660)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5779)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5660)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5779)	Truncated file: /var/log/Xorg.pid-5779.log

Source: /usr/bin/pulseaudio (PID: 5575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5779)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5800)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5819)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5829)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5859)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6084)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5523)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5574)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5575)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5654)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5660)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5711)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5723)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5770)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5777)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5779)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5813)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6197)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5799)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5800)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5819)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5829)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5859)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 6036)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6231)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6233)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6234)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6238)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6244)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6257)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6084)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6206)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6211)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6277)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6687)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6693)	Queries kernel information via 'uname':

Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.070] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.800] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.190] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:29 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 196.506] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.685] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.086] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.488] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.011] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.864] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.765] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.074] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.756] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.078] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.882] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.911] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.803] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.493] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.055] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.626] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.198] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.585] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.710] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): vram: 4194304
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:30 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) LoadModule: "vmware"
Source: na.elf, 5531.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.zmhMtq
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.505] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.326] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.588] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.374] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.756] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.743] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.115] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.955] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.837] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.471] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.828] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.359] (--) vmware(0): vram: 4194304
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.635] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.672] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.306] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: na.elf, 5531.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.zmhMtq
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.863] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.720] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.839] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.390] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.958] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.562] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.366] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.532] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.308] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.127] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.532] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:31 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.876] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.287] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.168] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.964] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.662] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.162] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.808] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.659] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.554] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.087] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.498] (==) vmware(0): RGB weight 888
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.906] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.503] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.964] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.761] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.942] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.571] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.489] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.771] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.433] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.081] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.358] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.706] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.227] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.003] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.519] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.982] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.763] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 196.709] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.812] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.782] (==) vmware(0): DPI set to (96, 96)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.085] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.873] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.682] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: na.elf, 5525.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.U0cr3W
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.772] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.406] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.970] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.375] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.911] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.446] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.561] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.506] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.479] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.017] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.559] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.416] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.277] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.804] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.748] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.391] (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.496] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.667] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.553] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.097] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.318] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.116] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.357] (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.944] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.266] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.429] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.450] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.388] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.868] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.298] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.754] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 202.509] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.656] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.396] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.705] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.170] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.101] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:35 galassia /usr/lib/gdm3/gdm-x-session[5779]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.883] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.898] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.272] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.106] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.554] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.184] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.730] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 213.002] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.783] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.693] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.956] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.052] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.548] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.920] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.094] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.237] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.965] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.948] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.720] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.570] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): depth: 24
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.675] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.749] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.522] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:30 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) Module vmware: vendor="X.Org Foundation"
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Silken mouse enabled
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 197.944] (II) vmware(0): Creating default Display subsection in Screen section
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.595] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.911] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.455] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.139] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.770] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.287] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.411] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.587] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.790] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.737] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.149] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.186] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.101] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:35 galassia /usr/lib/gdm3/gdm-x-session[5779]: (WW) vmware(0): Disabling 3D support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.367] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.774] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.723] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.586] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.455] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.407] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.618] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 196.611] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.168] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:30 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: na.elf, 5523.1.0000559045d2e000.0000559045e7f000.rw-.sdmp, na.elf, 5525.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5526.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5529.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5531.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5532.1.0000559045d2e000.0000559045e5c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.062] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.916] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.659] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.742] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.652] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.488] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.381] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:30 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.366] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.068] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.664] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.202] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.089] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.689] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.503] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): mwidt: 1176
Source: na.elf, 5523.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5525.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5526.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5529.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5531.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5532.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.332] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.617] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.017] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.789] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.338] (--) vmware(0): depth: 24
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): RGB weight 888
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.208] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.814] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:36 galassia /usr/lib/gdm3/gdm-x-session[5779]: (--) vmware(0): bpp: 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.872] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 202.554] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.465] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.772] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.679] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.062] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.793] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.405] (--) vmware(0): w.red: 8
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.248] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.934] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.425] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.147] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.666] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.413] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.228] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.831] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.704] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.260] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.988] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.178] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.251] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 213.026] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.308] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.432] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.841] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.744] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 207.432] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.925] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.077] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.581] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.607] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.448] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 202.535] (WW) vmware(0): Disabling 3D support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.700] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.151.dr	Binary or memory string: [ 202.566] (WW) vmware(0): Disabling RandR12+ support.
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.099] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.317] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.367] (--) vmware(0): pbase: 0xe8000000
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.781] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.778] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.548] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.723] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.497] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.647] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.991] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.904] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.820] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.611] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.853] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.404] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.211] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.359] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.598] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.965] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.855] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.646] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.193] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.238] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 197.303] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.856] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.398] (--) vmware(0): bpp: 32
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.735] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.219] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.476] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.032] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.976] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.652] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.129] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.022] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.466] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.247] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.994] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.894] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.671] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.449] (--) vmware(0): vis: 4
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.715] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.480] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.695] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.537] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.430] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.694] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.680] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.654] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.627] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.605] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.342] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.574] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.588] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.761] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.295] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.447] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 202.579] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.669] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.032] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:45 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.480] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.407] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.628] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.471] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.514] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:40 galassia /usr/lib/gdm3/gdm-x-session[5779]: (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.870] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.178] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.822] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: na.elf, 5525.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.U0cr3W
Source: Xorg.0.log.151.dr	Binary or memory string: [ 212.882] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 205.202] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:46 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: na.elf, 5523.1.0000559045d2e000.0000559045e7f000.rw-.sdmp, na.elf, 5525.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5526.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5529.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5531.1.0000559045d2e000.0000559045e5c000.rw-.sdmp, na.elf, 5532.1.0000559045d2e000.0000559045e5c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.151.dr	Binary or memory string: [ 203.610] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 204.074] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 196.574] (II) LoadModule: "vmware"
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.118] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:38 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: na.elf, 5523.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5525.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5526.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5529.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5531.1.00007ffef384b000.00007ffef386c000.rw-.sdmp, na.elf, 5532.1.00007ffef384b000.00007ffef386c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:39 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: syslog.24.dr	Binary or memory string: Oct 6 15:28:37 galassia /usr/lib/gdm3/gdm-x-session[5779]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.151.dr	Binary or memory string: [ 206.460] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5695)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5523, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5525, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5532, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5523, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5525, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5532, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5523, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5525, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5532, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5523.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5525.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5531.1.00007f07b0017000.00007f07b002d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5523, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5525, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5526, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5529, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5531, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5532, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	79%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.24.dr	false	unknown
http://wiki.x.org	Xorg.0.log.151.dr, syslog.24.dr	false	unknown
http://www.ubuntu.com/support)	Xorg.0.log.151.dr, syslog.24.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
221.51.233.208	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
120.20.155.25	unknown	Australia	133612	VODAFONE-AS-APVodafoneAustraliaPtyLtdAU	false
48.82.49.24	unknown	United States	2686	ATGS-MMD-ASUS	false
146.202.68.210	unknown	United States	6871	PLUSNETUKInternetServiceProviderGB	false
196.19.248.144	unknown	Seychelles	134451	NME-INDONESIA-AS-APNewMediaExpressPteLtdID	false
113.65.120.227	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
222.192.215.125	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
170.255.151.37	unknown	Belgium	5400	BTGB	false
139.234.234.246	unknown	United States	1462	DNIC-ASBLK-01462-01463US	false
46.42.188.202	unknown	Russian Federation	29125	TATINT-ASRU	false
8.153.127.188	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
185.114.210.157	unknown	Switzerland	199366	TTNETDCTR	false
147.99.53.23	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
65.163.214.121	unknown	United States	1239	SPRINTLINKUS	false
188.16.229.208	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
139.240.110.249	unknown	United States	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
131.248.46.229	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
96.25.164.184	unknown	United States	16625	AKAMAI-ASUS	false
160.248.62.49	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
92.248.239.239	unknown	Russian Federation	30868	OLYMPUS-NSP-ASRU	false
158.107.95.64	unknown	United States	26423	DOMRESUS	false
82.146.113.101	unknown	Belgium	8201	EVONETNL	false
111.104.247.47	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
37.78.186.66	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
220.145.240.163	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
87.7.77.246	unknown	Italy	3269	ASN-IBSNAZIT	false
180.99.235.197	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
207.71.175.211	unknown	United States	26962	IPROTUS	false
86.52.166.200	unknown	Denmark	197288	STOFANETDK	false
77.77.145.223	unknown	Bulgaria	49849	MG2002-ASBG	false
222.44.27.164	unknown	China	45057	CNNIC-TIETONG-APCHINATIETONGSHANGHAICN	false
64.230.137.56	unknown	Canada	577	BACOMCA	false
203.32.3.193	unknown	Australia	136518	WA-GOVERNMENT-AS-APWAGovernmentprojectAU	false
52.189.20.92	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.61.151.64	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
157.208.251.24	unknown	United States	54591	GOLDER-CANADA-RDCUS	false
143.195.96.236	unknown	United States	397112	ILLINOIS-MATH-SCIENCEUS	false
62.198.53.96	unknown	Denmark	3308	TELIANET-DENMARKDK	false
140.50.246.83	unknown	United States	668	DNIC-AS-00668US	false
112.148.254.210	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
217.229.172.238	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
97.164.241.103	unknown	United States	6167	CELLCO-PARTUS	false
193.43.19.95	unknown	Italy	137	ASGARRConsortiumGARREU	false
17.42.54.226	unknown	United States	714	APPLE-ENGINEERINGUS	false
43.18.143.225	unknown	Japan	4249	LILLY-ASUS	false
147.99.28.73	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
223.2.62.224	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
200.74.184.230	unknown	Chile	18822	ManquehuenetCL	false
165.109.170.218	unknown	United States	7926	FICOUS	false
5.94.49.116	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
44.63.210.154	unknown	United States	7377	UCSDUS	false
208.31.255.160	unknown	United States	1239	SPRINTLINKUS	false
35.251.75.229	unknown	United States	3549	LVLT-3549US	false
196.138.105.227	unknown	Egypt	36935	Vodafone-EG	false
176.172.105.197	unknown	France	5410	BOUYGTEL-ISPFR	false
45.20.50.217	unknown	United States	7018	ATT-INTERNET4US	false
46.81.62.24	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
8.102.49.53	unknown	United States	3356	LEVEL3US	false
112.175.220.146	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
72.236.116.155	unknown	United States	3356	LEVEL3US	false
143.223.25.239	unknown	United States	33371	WMA-BEVERLY-HILLSUS	false
36.70.76.225	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
223.34.195.103	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
60.94.29.133	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
36.135.10.213	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
59.225.245.31	unknown	China	2516	KDDIKDDICORPORATIONJP	false
150.179.209.175	unknown	United States	3479	PEACHNET-AS1US	false
206.55.88.224	unknown	Canada	21548	MTOCA	false
157.78.133.54	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
120.104.151.20	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
61.161.203.204	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
68.203.208.123	unknown	United States	11427	TWC-11427-TEXASUS	false
143.194.70.238	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
70.89.111.208	unknown	United States	7922	COMCAST-7922US	false
223.133.115.27	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
178.180.117.212	unknown	Poland	12912	TMPL	false
197.221.180.224	unknown	South Africa	37356	O-TelZA	false
147.89.189.201	unknown	United Kingdom	559	SWITCHPeeringrequestspeeringswitchchEU	false
103.239.60.33	unknown	Taiwan; Republic of China (ROC)	24157	VIBO-NET-ASTaiwanStarTelecomCorporationLimitedFormer	false
142.94.252.207	unknown	Canada	393952	GOANETCA	false
76.203.140.7	unknown	United States	7018	ATT-INTERNET4US	false
107.246.24.173	unknown	United States	7018	ATT-INTERNET4US	false
135.107.251.194	unknown	United States	14962	NCR-252US	false
220.124.150.248	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
132.137.64.203	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
54.29.80.29	unknown	United States	14618	AMAZON-AESUS	false
85.126.133.247	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
104.24.135.163	unknown	United States	13335	CLOUDFLARENETUS	false
111.132.36.100	unknown	China	24138	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
85.218.240.31	unknown	Denmark	197288	STOFANETDK	false
174.15.81.34	unknown	United States	6327	SHAWCA	false
108.229.79.62	unknown	United States	36351	SOFTLAYERUS	false
222.191.7.185	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
101.35.205.151	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
190.67.85.74	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
155.58.182.8	unknown	United States	23366	LSUHEALTHSCIENCESCTRUS	false
25.81.236.21	unknown	United Kingdom	7922	COMCAST-7922US	false
65.196.3.55	unknown	United States	701	UUNETUS	false
171.98.3.221	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
186.15.95.80	unknown	Costa Rica	52228	CableTicaCR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
120.20.155.25	UrgAIdh1gO	Get hash	malicious	Mirai	Browse
120.20.155.25	Ft8fC6AZiY	Get hash	malicious	Mirai	Browse
146.202.68.210	IYn5yyW2Fx	Get hash	malicious	Mirai	Browse
113.65.120.227	mips.elf	Get hash	malicious	Unknown	Browse
96.25.164.184	arm.elf	Get hash	malicious	Mirai	Browse
92.248.239.239	YnUkM9d4cN	Get hash	malicious	Mirai	Browse
158.107.95.64	o85sjrF5oi.elf	Get hash	malicious	Unknown	Browse
82.146.113.101	x86.elf	Get hash	malicious	Mirai	Browse
82.146.113.101	mips-20221021-0638.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGAINFRASoftbankBBCorpJP	na.elf	Get hash	malicious	Mirai, Okiru	Browse	219.176.161.107
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	126.109.152.36
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	126.139.28.45
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	218.127.133.200
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	60.156.44.35
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	126.26.24.77
	na.elf	Get hash	malicious	Mirai	Browse	220.56.85.10
	na.elf	Get hash	malicious	Mirai	Browse	126.69.193.52
	na.elf	Get hash	malicious	Mirai	Browse	219.172.231.2
	na.elf	Get hash	malicious	Mirai	Browse	126.54.48.184
PLUSNETUKInternetServiceProviderGB	na.elf	Get hash	malicious	Mirai, Okiru	Browse	194.75.109.229
	na.elf	Get hash	malicious	Mirai	Browse	146.90.104.27
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	51.9.86.193
	https://gfsaryyy.weebly.com/	Get hash	malicious	Unknown	Browse	217.32.182.91
	SecuriteInfo.com.Linux.Siggen.9999.1529.24643.elf	Get hash	malicious	Unknown	Browse	91.125.161.103
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	195.213.74.58
	S1WVSiZOLX.elf	Get hash	malicious	Mirai, Moobot	Browse	80.189.198.144
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	31.125.98.127
	mirai.dbg.elf	Get hash	malicious	Mirai	Browse	212.159.41.164
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	87.113.68.2
ATGS-MMD-ASUS	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.22.246.59
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.11.106.110
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.201.63.95
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	48.8.237.251
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	57.63.222.41
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	32.152.190.253
	na.elf	Get hash	malicious	Mirai	Browse	48.26.151.120
	na.elf	Get hash	malicious	Mirai	Browse	48.5.241.24
	na.elf	Get hash	malicious	Mirai	Browse	34.147.20.209
	na.elf	Get hash	malicious	Mirai	Browse	32.16.6.68
VODAFONE-AS-APVodafoneAustraliaPtyLtdAU	arm7-20241006-0950.elf	Get hash	malicious	Unknown	Browse	101.116.109.67
	yakov.m68k.elf	Get hash	malicious	Mirai	Browse	101.113.53.90
	BJgQPShJE7.elf	Get hash	malicious	Mirai, Moobot	Browse	120.21.162.55
	SecuriteInfo.com.Linux.Siggen.9999.14022.17442.elf	Get hash	malicious	Mirai	Browse	101.121.230.221
	94.156.71.153-sparc-2024-08-29T17_31_55.elf	Get hash	malicious	Unknown	Browse	101.119.114.181
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	120.20.167.20
	xd.arm.elf	Get hash	malicious	Mirai	Browse	115.129.176.72
	b3astmode.x86.elf	Get hash	malicious	Mirai	Browse	120.21.148.1
	teste.arm7.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	101.113.175.186
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	101.122.219.230
NME-INDONESIA-AS-APNewMediaExpressPteLtdID	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	196.19.248.111
	W5xi2iuufC.elf	Get hash	malicious	Mirai	Browse	196.19.248.111
	hyWl33Q2OI.elf	Get hash	malicious	Unknown	Browse	196.19.248.159
	mu3Tajj6Po.elf	Get hash	malicious	Unknown	Browse	196.19.248.131
	FDp7e6J4kN.elf	Get hash	malicious	Mirai	Browse	196.19.248.117
	2j5zwxO3H7.elf	Get hash	malicious	Mirai	Browse	196.19.248.134
	sora.arm.elf	Get hash	malicious	Mirai	Browse	196.19.248.125
	sora.arm.elf	Get hash	malicious	Mirai	Browse	196.19.248.130
	mips-20230709-1715.elf	Get hash	malicious	Mirai	Browse	196.19.248.135
	hoho.x86.elf	Get hash	malicious	Mirai	Browse	196.19.248.127

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5727/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5730/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5732/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5734/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5736/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5738/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5741/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	Unknown
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5813/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5843/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5846/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5848/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5850/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5852/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5854/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5857/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6039/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6197/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6214/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6438/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Vvn:F
MD5:	5608F90AF671C820934D00674E501EE6
SHA1:	4F56C22E6295812BDB27BEEBD97D543AC23D9F59
SHA-256:	AD6B26DA3E68C5FF3DB921ACAA3B6F049E95A562DFC184946376432609B2A003
SHA-512:	396E2FB07912CDEEBAC1AB63FF0487BC2FA6C4480DB45470500D956BA37FBB3B2B96147F48EA58BDC53FDE3795221482118E80E5F3E3914DC9519D0143055A16
Malicious:	false
Preview:	6206.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Gw:Gw
MD5:	E3BCFF987197AC489EDB2B5774746476
SHA1:	8BFF28B3C05E8F795418C9DF35870E8A1CCE9687
SHA-256:	7ED0E47B7CAB39FD1CF8ABCD026712C4F114674B46972DC0D451C3FD4898B3B2
SHA-512:	69401F66D4390B55BDBEDFA3390467B521633333A59D4AA6CF1D977B0EE5655000D3DF6676628F9A52AF8444815ED9AA1C445F3B98B9CFC4D7FFD14AF95B2C7F
Malicious:	false
Preview:	5689.

/run/systemd/inhibit/.#1jCgqqW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifq0IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfq0ApLHK7wR9n
MD5:	A8C2DFA63B2309A0B4AE6F64EE66AD4D
SHA1:	D2161CDC97C69E5B1E40BBC603FF159CB22E8806
SHA-256:	91F8D5C98B0BC8070B11480C853DDBC11449861AA595218823BC9CA3BD66ED53
SHA-512:	FE340406F94AEA1477F48AA673A214DB4E06BA0EAD4FF684754347C4444894645C24AF8855FCF8C9E71806EB1B678EDDDD40901176EF30816E7035EB8196FC7F
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=6046.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2JzQzWZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.20548808216266
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+6yYYgqKLXv0Rsz:qgFqXQXTI1IldVFqKjcRsz
MD5:	920ACCE85560EF3A8BC33A01006218B4
SHA1:	5180FE141C726CF9676FCDE7E05C9027AA9E2D71
SHA-256:	6A79036551A31CDA8899ABE5372EF832ECAF9D195F23E61BAA57C4AAF47C9CC1
SHA-512:	2BE7115E2688DA7AC5AC9135EE538689DDB35C8AF75076D05575A41AC37DBDDC82B063BB5DB88623CE22BC5A6AB807BEF45C6EA0365AB26F8ACE5EC269CA431A
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6244.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3XO2naW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.1669277917692895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++vyYYC3iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+6yYYgqKLXv0RT
MD5:	008B3FF926D2BBDCDC3F638C716D3696
SHA1:	93C75894E7861C3DDE4260AE905BCF9E15961DD4
SHA-256:	4136A5F75BEE1B85D36B4174B53006908ACA7FCF1F02C8B05E78E96EB521CDF4
SHA-512:	FAC9F5278944C1449B435FDEE8147897A6A8AF43A0DC69D3434263FA7D1074E212A0E4EED203F1B1DF13AA2C3BE4AFF216182BE0D55A8EBD2B5F11F4E9109820
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6244.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4wOMjRX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.152041866447974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++3qI3iXulpv5RX8/SflY:SbFuFyL8OAAx+elpLRS
MD5:	91986A488CD430A3F4682E668D58B53A
SHA1:	2145B44800421BD82BFB1A7E02015056E67A168A
SHA-256:	0113735B365AE118E1113B3543473E1C65AD47162C4DE1CCB351C65C4E121071
SHA-512:	0CCD1F2EF66FD9913E548E9A63B1A1E4811AC9C21AA13FBA30742713334FA8D20617814F4B25788BC14FD717C71E4DA41F836A43431A9ADD413E6CBE7C20E69B
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6257.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat0HA3C8W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0JQh1IV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Ks2yQW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Oks08X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0dYsvIV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0j1ePNZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0yXtEjY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/sessions/.#c1AwLwTY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420485739341213
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRpBgKG1Y:qgFqPuFN6IG0n99x2xayWRpBgt1Y
MD5:	93F146CA37EE9FF555FD8522E9028492
SHA1:	D53FBA16B18014FA9C59323DCD92C00AC752BFF3
SHA-256:	032E12FA57AEE41386C225793DBD710787104D5DC83DC75BD073585791CED108
SHA-512:	F32C4ABA0E06BD3AF4C7F920BC6A238DEA21820BD4DCB1EEE8E8E7AD5A29E39447AC5831124425B7B78396E7CAB378E63090671539CA2F3488A6ACF80EC6A976
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.

/run/systemd/sessions/.#c1DMnAzY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.377473040560551
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBRpBgKG1Y:qgFqPuFdDJIi9x2xayWRpBgt1Y
MD5:	5F50160885F207DE9210EF6A50954E28
SHA1:	653D318E4EB10C123308FB81997FA92839C4960F
SHA-256:	F51D0C5601D34BD9858E0E082516B995888EEF8497CDB389F09746A935302F33
SHA-512:	E5810AC862D4F4466B0D7B503DC406A34172A2098CB6E1F2B97DB0BEA4A3BBE4B264C002FC49A081A3467249F03E910328341A97EB2AB1B121FC91BA7C3235F8
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.

/run/systemd/sessions/.#c1K3B0AZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420485739341213
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRpBgKG1Y:qgFqPuFN6IG0n99x2xayWRpBgt1Y
MD5:	93F146CA37EE9FF555FD8522E9028492
SHA1:	D53FBA16B18014FA9C59323DCD92C00AC752BFF3
SHA-256:	032E12FA57AEE41386C225793DBD710787104D5DC83DC75BD073585791CED108
SHA-512:	F32C4ABA0E06BD3AF4C7F920BC6A238DEA21820BD4DCB1EEE8E8E7AD5A29E39447AC5831124425B7B78396E7CAB378E63090671539CA2F3488A6ACF80EC6A976
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.

/run/systemd/sessions/.#c1LUhZRY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.484312623672443
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRmUKBhcIS3xffx8xfx2xNIByy6GBRpBgKG1Y:qgFqPuFVuRZI4BZ89x2xayWRpBgt1Y
MD5:	23A25FDD5E90F5E4E70141C07BBA019D
SHA1:	5FFD434C5B70B04AB0E9E36A23A48101332624A5
SHA-256:	887D8FA09C4567279B90DA5F56E4DA757F7DC3CA22F0BEF074D037F986F344A5
SHA-512:	FDC15E2728357A9D0E9867DC19F9452ABCD375FD6497DF2428646BAD70FC24673FE75743D77A0001FFB4C114A472707E42F22360885AE65A8F985F11ECDE8A6B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7968.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.

/run/systemd/sessions/.#c1Uw5HkZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420485739341213
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRpBgKG1Y:qgFqPuFN6IG0n99x2xayWRpBgt1Y
MD5:	93F146CA37EE9FF555FD8522E9028492
SHA1:	D53FBA16B18014FA9C59323DCD92C00AC752BFF3
SHA-256:	032E12FA57AEE41386C225793DBD710787104D5DC83DC75BD073585791CED108
SHA-512:	F32C4ABA0E06BD3AF4C7F920BC6A238DEA21820BD4DCB1EEE8E8E7AD5A29E39447AC5831124425B7B78396E7CAB378E63090671539CA2F3488A6ACF80EC6A976
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.

/run/systemd/sessions/.#c1VOXiTX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.428822847972203
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBRpBgKG10X:qgFqPuFN6IG0n99x2xayWRpBgt1k
MD5:	13F8D0B45CE2F7E61EEC3880FCA163B8
SHA1:	65027C156BBDACFD9C473D462A3DC3B1D61D3204
SHA-256:	C16A79E394038FC8A7E9C15DC0082D64BD5B28DF06CD61E3F2AC5D83DE14B523
SHA-512:	A65888B82D3BB57E261E4A283E9DFF44486DBC40BEE342D59BDA545E3EE1CC32C83306C31A04C81A6515F8FE7503243EE2949DFD1E1356132EE2F03AF7897F16
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5711.REALTIME=1728246495951008.MONOTONIC=182495704.CONTROLLER=:1.15.

/run/systemd/sessions/.#c25WN7tX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.442757965243464
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0m8:qgFqPuFNuCH0nI9x2xayWigFGm8
MD5:	0C7B2B5C32E2FA649EAACD0473662AB8
SHA1:	DDEA1A0F4CEF7342EF01BD91D2AAB7604428EF17
SHA-256:	5C719CBE4F7EF3AA8E29AF345F3CB64069B829A2B4D162FEAC1D7756285DB31E
SHA-512:	B23811761450FB714799647CF2CD682AC76460B78BE77DDF1AEF1CCDBEEAF8FD7D0328947C2E56DBBE3F2588BAE26E0C5FD7C7816AE1FAD0DC05F78E41ED00AA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.CONTROLLER=:1.19.DEVICES=13:64 .

/run/systemd/sessions/.#c2U3kGSZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.416894650095673
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0n:qgFqPuFNuCH0nI9x2xayWigFGn
MD5:	A14D2D7188C8B932BDD72B8CCF1998C7
SHA1:	0880A764953A0513AD0CB37EB9F8E1BB691DDD74
SHA-256:	495A7943101C37C5D11663F5B33FDCE0CBC365D71371F468D9E1D1BF5AA5670D
SHA-512:	4ABEA38E230A0AC64ADCB82B980ADB77F4031C4DB1D463E2C9CB26307F495B0FD449B6846AEDBF0B7B8E523900D8AC7DA65C796AE76399F9A0AD56C657ED776B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.

/run/systemd/sessions/.#c2XkJsNW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.456998419704189
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0mZ3:qgFqPuFNuCH0nI9x2xayWigFGmZ3
MD5:	9631566932C3F6266F8212712CF08BC5
SHA1:	9888A4A61B3F4F629CD37D3BFACB697C0AFB26D3
SHA-256:	BAD322C9ED8F828213D2BD0DA6EE6B7FE0D216D8E791AB5018E3107D7410C90E
SHA-512:	FF3B57652EFB96FAF3F83419AFF1F4DD374019F7C7B7F6276790713D63E7005CD00C1CC502D64DD7EDCBC77D89B67B8F50A3BC7F09E8CF3D49372FF9A007F487
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.CONTROLLER=:1.19.DEVICES=13:65 13:64 .

/run/systemd/sessions/.#c2YQNfa0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.427155267120949
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0m8:qgFqPuFNuCH0nI9x2xayWigFGm8
MD5:	88B06ED35FFDAB8B51B78929EC98E242
SHA1:	EC0FC2BA9B2FEA90995DB6DF31DEA9B0AFB0A365
SHA-256:	2649C43C3CEAB193A1A8EC7185B7375F3AED36E4C145F877A6383647F135498F
SHA-512:	34BE4FFA499F46185D53F280088083C15093973113717899F78531AD09E2BF36A1C7426621FEA71C7FCB390098C52C3A86EE0C4DF698A1C08322D7FC9AE38332
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.CONTROLLER=:1.19.

/run/systemd/sessions/.#c2aKJAZV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.416894650095673
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0n:qgFqPuFNuCH0nI9x2xayWigFGn
MD5:	A14D2D7188C8B932BDD72B8CCF1998C7
SHA1:	0880A764953A0513AD0CB37EB9F8E1BB691DDD74
SHA-256:	495A7943101C37C5D11663F5B33FDCE0CBC365D71371F468D9E1D1BF5AA5670D
SHA-512:	4ABEA38E230A0AC64ADCB82B980ADB77F4031C4DB1D463E2C9CB26307F495B0FD449B6846AEDBF0B7B8E523900D8AC7DA65C796AE76399F9A0AD56C657ED776B
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.

/run/systemd/sessions/.#c2blc1TW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.464139630347304
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0mZk:qgFqPuFNuCH0nI9x2xayWigFGmZk
MD5:	F6B0328DF56750D2A0EE3D5E3F6EF88B
SHA1:	A571BD501FFE57CEB39567225991EBF24EBDDA70
SHA-256:	5284D920630EFBD5782C0619B6B3A5B3E3BCDD6FEB093D2946CE874CB906A1D4
SHA-512:	590C9621F12EF098C543474894986D37A962F26971F789737B57E1626F3EB5133E70AAEE45EDFC0AED209A600AB4A9F1A6B66E6A51265C9D82563EC6ABE1D471
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.CONTROLLER=:1.19.DEVICES=13:65 13:67 13:64 .

/run/systemd/sessions/.#c2yKAIsX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.467796078344993
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBigXV3cPE0mZen:qgFqPuFNuCH0nI9x2xayWigFGmZen
MD5:	429BF5014A83D4F473C97CFD7C3DEB99
SHA1:	18F8A4294125AF9B17D1D026993179949C7FE2F2
SHA-256:	AE602237C26428F0155D689FBED4FBB49BAF898D351DAD8D291286AD263813B9
SHA-512:	AAC3E5E238BB913D2DAE9F7834BD70A13B0D80BAA34C79080CFFC519D2A1D6308AE7322F1730AD11F72C7D2941FA1935356146E4403F987E6D75FABA29AFB8AE
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.CONTROLLER=:1.19.DEVICES=13:65 13:67 13:64 13:66 .

/run/systemd/sessions/.#c2yu52CZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.481059316473908
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffcxfx2xNIByy6GBigXV3cPE0n:qgFqPuFVuRpCvBU9x2xayWigFGn
MD5:	3687E99183B076C99F44134937B3F15F
SHA1:	3D2B1D2A73F98228212B10BFCBAC703DE061C0D0
SHA-256:	4640E177979FC1E9221468596AD8B23EFA9620A64227200F1984291C18C82FD2
SHA-512:	4BD67B83BDCB079644792CB0042CB01420FCCF947F851A66213C11B064B23A065F3DED695DABB7E243A78A09CB7744615C5014B8AE529C5E6EBD6452CC60FD37
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/8031.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5770.REALTIME=1728246505652978.MONOTONIC=192197674.

/run/systemd/users/.#1275qdhNY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.298634383759379
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffF5JgK/D2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBN7g9thQHtPYq9M
MD5:	69EF68BCDFF09337CE48A8260FF14088
SHA1:	4220282F35F6C5D04CB27CCD85D411F4965BE6B1
SHA-256:	7BD0B6623C1544DC1D91555821F143161D2521964A0CE3E6C570FD04875ED97E
SHA-512:	83273037FAC83741415C6DF78C9A74D1E87B1A28C2F5CF51BC9682ECBB2887046973BED262A5CAD503D1EB760204C085624975719DC40EA1231986EBDD36A9D2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7906.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278sL5FV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1557600722542745
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgK/D2thQc2x9sS02/g2owB:qgFq30NzL/ixeg9thQHxbPYA
MD5:	9A0B824A37F905AD3D694B5FB2766919
SHA1:	8221305E5E27A7F2003FB6E9BA53869615FE48CB
SHA-256:	AB2A3A7A03669E11D0DC846C20639E531A123EAF62C765AAF8501BE8055FAD73
SHA-512:	79BE405E130CF72D1CF85C5DEC1E4CA8A04F3EFAC5F5CFA77915DE4E3A783C76121937CDDBB0681A633572752218CF84927F7E2956FDC3F116852E799316C64B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127GD0xd0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.302681824626415
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffF5JgK/D2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBN7g9thQHxbPYA
MD5:	39B7FA28AA35CD5AECB4D74A6E5FB260
SHA1:	EDDEC81BD6028B45142F8DB216C3B28AEEA34E21
SHA-256:	280F69EE8663FA5F9E3129F47FC6CADAFE7C5DA30FBCC753E85B6C86E471BDF2
SHA-512:	5773C6D3837944C196C5FE60D80A4D497CD47859EE2720A4CA76F3FE30C1184F236A4A9B415EF6A67E0FCE360F6420694142D1FDFC377C8FE2A7FCF9E83C82FB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7906.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127OC9QJX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VWIOlW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.171696327234355
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgK/D2z5c2zw02zb2owB:qgFq30z1cL/ixxTg9z5HzwPzbA
MD5:	7927E05617F51979B5093F9179B5EB26
SHA1:	E0071801D03F4A89CE2D78FD782DBEE8FE7A2AA8
SHA-256:	5DB596DCB6ADC046F6F3175FA617B80848AF66B51AA96BDE5C566EDF58521986
SHA-512:	F1B1F2425E1DF60A5F8D5A2F0C443B767209D8A9CFF1F2E6532379DDC381C6AB872A3F1A091CCF098A268D4BD9580A44106675CF489A65B442044A1C91B4A35E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hNF3sX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.171696327234355
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgK/D2thQc2x9sS02/g2owB:qgFq30z1cL/ixeg9thQHxbPYA
MD5:	8D999751B5B82A2B77364D6E061F4F31
SHA1:	3A5F31C2803BB66ADB0F42CC4024C30BFA5115D8
SHA-256:	7CB809A7C4BE650AFBBBB3EA2795972BD49EEFD2A4ECB2C83D3D31E70EF25AAE
SHA-512:	94A15FD952D87E50760FD97DDA595DF01924F66A43E71FB7113125056CBF343A90D595AC5A972A18625289EFF379A428E6FA9CA2D3DF76921360CE5A25ED0505
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127mylJRV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.151021569368439
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgK/D2z5c2zw02zb2owB:qgFq30z1cL/iRJg9z5HzwPzbA
MD5:	9BF8A0EB74CFCEB873AD4FA00E135AEA
SHA1:	24772686BC00729268F99EAFD5402B3248DBE396
SHA-256:	E6A61E0CB881188C6F2B68FE6E24DADD9D0AC30F371F591E40674CA28C060992
SHA-512:	B1F6B1CD26BECCF25CEDD329C1AF67A21B5A760DDF423BD96B8BB8D6F6A5D24995417AD43A2B550270ADD2297BAAB675FF0C6137590E5A5AA32D7C3EA711E315
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nCmhuY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.156648656223084
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgK/D2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg9thQHtPnmDq9x
MD5:	27676BC942364488B36D171FD4C8AC08
SHA1:	3658439BED9E4C6E3A7AE29FF56E5D0B6A42C299
SHA-256:	B09593D109DC186D9C0238ECC201C2562229AAE72268C7F8174382C010CD922F
SHA-512:	FDE5E2B52763975F5AC057EC95BFCF415C63D0332955A6A5A8D6AB610386FAAF902A4EAF686554B3FD2537400832D42851609CB0C9F0E72A1AD1AFFFC59FA033
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127nr3BJZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.1557600722542745
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgK/D2z5c2zw02zb2owB:qgFq30NzL/ixxTg9z5HzwPzbA
MD5:	48F0ED61FE6922AE9E404CF314680FC5
SHA1:	0BB10945BD06AB30B35E91DEBAD9F7412A764884
SHA-256:	288AD28CE5299E503CCA3348DE56C9C76A27D8A31FF3DE1375984A1A4CE4B248
SHA-512:	CA2882E319D72AED97C4B444E73DC345AE0143F8BD553B3CA4A553C3E22DE5A0B888133C9B6CC5E0FAC28F03F6D29F2F1F20237AC5CD0EF88E86D47EBE009770
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127r9CKxX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.322051617252186
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffTlpSfgK/D2thQc2x9sS02/g2owB:qgFq30VuR8L/ibBmg9thQHxbPYA
MD5:	4D5ABECA396849B90AEBBB21027E3F2D
SHA1:	2AD22B9BDD7791691919FF089FCD9C7F5B6757D4
SHA-256:	6472B4AD4D7C999270F55B15A9708FB8E1BC29AB8C750FE5428459EA27B782C7
SHA-512:	6062748531DCCC5AC84248FA43CAC88B76D235E4672EF9972FD3DA0374DD0BF10BC06B10DDD6026441EB8FF4099AEF52C838B30B9370D568DB6C913BAAC0B731
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7906.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127tJLF7Y

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.172173090183657
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgK/D2thQc2x9sS02nmD2owC:qgFq30dAL/ixeg9thQHxbPnmDd
MD5:	69D126C6DAE7EE192C81798F7E7C442E
SHA1:	1CE52845B9D7CCF8C4B616E9FEB846E4B8D13A20
SHA-256:	D70B59869D50CC88F1FF1F8F4B2696FEF6C382C70109A2C692B0635524F8D990
SHA-512:	8FDC581ABF59453CA30824C5246BC790D64DF51CE1321BA6445C8002D5E87790A753E6ED4F2762A97C9EE5D524C0EDACCB681FE95F30D05DAE2C30540A615333
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127v5ggYV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.156648656223084
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgK/D2thQc2pb02nmD2p9rwC:qgFq30dAL/ixeg9thQHtPnmDq9x
MD5:	27676BC942364488B36D171FD4C8AC08
SHA1:	3658439BED9E4C6E3A7AE29FF56E5D0B6A42C299
SHA-256:	B09593D109DC186D9C0238ECC201C2562229AAE72268C7F8174382C010CD922F
SHA-512:	FDE5E2B52763975F5AC057EC95BFCF415C63D0332955A6A5A8D6AB610386FAAF902A4EAF686554B3FD2537400832D42851609CB0C9F0E72A1AD1AFFFC59FA033
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246495925919.MONOTONIC=182470615.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.3709505944546687
Encrypted:	false
SSDEEP:	3:FS6n:9
MD5:	28053D385141B8FEEF04B56DB714B0C8
SHA1:	5E6A88924168D49A6AD3CC73A5325B75D20194DF
SHA-256:	5EF1B7BA6E535D8C4C706318AAB9A43EB9D2B2953A5BB7840C6F791DD5ECEBED
SHA-512:	AC18447943C541EFCFC7A5809FFD90DA0F23B7A5E01F75244A274CC6DC728A70610E6D76A8CBCB801914BC54B7DB632F22B9B73CD458914056EE82DA161FFF08
Malicious:	false
Preview:	5575.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	6.0161700248413394
Encrypted:	false
SSDEEP:	12:OxP6ZwveY+68CxP1ZWiveY+1AxP1e/qOveY+1e5exPcYGwoveY+cYyOOveY+cYLh:h2WBqeYvqH0AI
MD5:	6AB0212C35B5EA2437E64CAC565C87E9
SHA1:	3DB078602FF05A817625AD9185EEE939C81B537E
SHA-256:	E0CFE3A0485D841823F291F6F4A687A6409F6236BFB011D8BFAACCA7866A2661
SHA-512:	37AC1508B30862726FB1F37FDA3F534326F5B2CD9ECAA8EA07575810AC55F02F484581063DF3FEDD13756BC87F49B4C3607FF4355D2B7E37EC1882B17B18235C
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5799..MIT-MAGIC-COOKIE-1...&F..dC...t,-5...XSMP...#local/galassia:@/tmp/.ICE-unix/5799..MIT-MAGIC-COOKIE-1......"U.....Q._...ICE...!unix/galassia:/tmp/.ICE-unix/5723..MIT-MAGIC-COOKIE-1......_.X...n:.j.7..ICE...#local/galassia:@/tmp/.ICE-unix/5723..MIT-MAGIC-COOKIE-1.......$..'...t....XSMP...!unix/galassia:/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1....d....2A..A p....XSMP...#local/galassia:@/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1...td.).-..7...C&..ICE...!unix/galassia:/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.. ..a.<...k#8..U..ICE...#local/galassia:@/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.....e....N`.R.H/..XSMP...#local/galassia:@/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1..0].".y..-=.#s....XSMP...!unix/galassia:/tmp/.ICE-unix/1444..MIT-MAGIC-COOKIE-1.._.,.m'.z.W..,.....ICE...#local/galassia:@/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1....s..<.....z...ICE...!unix/galassia:/tmp/.ICE-unix/1498..MIT-MAGIC-COOKIE-1.........@>.....9..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.8653653400210795
Encrypted:	false
SSDEEP:	3:rg/WFllasO930vlz1lJOtWFllasO930vlz1lJk:rg/WFl2ptWFl2P
MD5:	79268AF979050DE191F71870F5BBA5B2
SHA1:	C3AAF3CBB2E005B8D85880CCE0EA37D9A24A7F41
SHA-256:	84A99FA95A4ACE5E2679FF2FAE27E7F7196077789452B7F4C0D1B012D0C32F13
SHA-512:	34842D4B8683DBAC48E608E26C37D0BEC41271281D9EB9AA6FD05E202F5FBE9A414E4CD70D57550314B899A5FBE0FC81C6A6A5B203C5D0E25A8F4D8CF2EEEFCB
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..NEN....Ny.+........galassia....MIT-MAGIC-COOKIE-1..NEN....Ny.+....

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:dn:d
MD5:	8BFF0A356040709ED13B6D8635D23E47
SHA1:	BD95BDEE7531012E681D71D53E99ABE686326C13
SHA-256:	ED5D589A5C2D35366814CFB4E100C02CAE2F66A9B69312226631C6C627DBB8A2
SHA-512:	583E879C81E549D0A0095C617D8AFBB7C051A6E148766925ADCBBDC250019D3CBD49E68FC7A558DF5813528F331A12637DC808E9F640018AAF1BBF0F6ABFC561
Malicious:	false
Preview:	6084.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6670868467684751
Encrypted:	false
SSDEEP:	3:xs1sXlXEWtl/Fh:qQ+yl
MD5:	E53C58800AF4AECE13919772287B6EAD
SHA1:	5FC4C56FF741B5F336319C52EA3954FC86164A81
SHA-256:	08621F01D09251A01FF2D21564F99DCDA34F33C64A6D6BDC74B607C3843CF648
SHA-512:	D4193AF5C4BE2C1C864C9FFB9903F763537CACD351865C5E413AC4E54A17EF0129BC7D14FEDC5A684A8C9E8B5C65462D89D11A402EF7AF9722D8D61B7883A1CC
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.D......................................

/tmp/qemu-open.U0cr3W (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.zmhMtq (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.62NEV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.H29EV2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.164451900686937
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWUws9/XDTlA:q5sU3LWfLUDmQymqSFbfomSqzFXjfK
MD5:	7F21E22EC43E15A31F5B77DFC8B32D37
SHA1:	C5ACE5E7F09DDA25F184EBD712A419B14A6A71E7
SHA-256:	7B2E55E6052AFA7B8AFEA748DB78C8D89CECA8CCC8D9B890B23A31F5B24B02E2
SHA-512:	2C070C0CAE0827F9B249D40B307882EE31F14FB0CD56998DA227C6E9FCB233AAF299B48224A70868833949B30D5A439EBE00058FF377CABB2A540FD3564705D1
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-T0tSEqr9,guid=f5505648f852198abd7a347d6702f317.IBUS_DAEMON_PID=6001.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.280995465136609
Encrypted:	false
SSDEEP:	384:RJwUWu/WipMUdMdpd/d2dCd3dHdIdGdmdWdQdQdedHdRdNded8dNdmwdzVdZfdFt:XwU3eloRRaYH/dSJrP7NYosXJ
MD5:	421197F239433781E2E89BAC7D3BEEBE
SHA1:	41AD59B9DFE64DD67D7001C114FF91B80CE74AF2
SHA-256:	9EBC4354A31ADF6E980401DFB6D7B6470E1DBDFB3C17200BAF1732CC40C6D633
SHA-512:	E1249503811AF444C9058B09F2FB232C8DC4292B1CD61D4A8162CB25BDBB8D452E2D15C046D3D528031DD2957366DD2CBD81DFE2ADD137642CF20F8C22F1B94B
Malicious:	false
Preview:	[ 193.702] (--) Log file renamed from "/var/log/Xorg.pid-5779.log" to "/var/log/Xorg.0.log".[ 193.728] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 193.740] Build Operating System: linux Ubuntu.[ 193.750] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 193.756] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 193.784] Build Date: 06 July 2021 10:17:51AM.[ 193.802] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 193.810] Current version of pixman: 0.38.4.[ 193.820] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 193.827] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.9755130594596
Encrypted:	false
SSDEEP:	24:KZ48ZeTLB5wAvjA2+V+7JqiNJpirCQU/eg/tFdv/+OdcXju6NueirboQTirCQU:Vv8fV8cXrCJ/eg/Nv/kOTrbojrCn
MD5:	FAD17D135D4908DEA79E34D950F0A754
SHA1:	BB7E8F5C000288C1658A2FCA37B42B00055B5A13
SHA-256:	A54206AE45461DCC38F9D620040FBA49FD92941BC83B4FE162922C39820B5D8F
SHA-512:	F5F5A020750DB89164A5ED61667885C5960F3E82841224FAE14B356CFFDE3DFAE4EE44711ABB179BC942CA33A4946FEDFF5E02AF68E790BC9096C8CE6631D443
Malicious:	false
Preview:	Oct 6 15:27:53 galassia systemd-logind[5591]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 6 15:27:53 galassia systemd-logind[5591]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 6 15:27:53 galassia systemd-logind[5591]: User enumeration failed: Invalid argument.Oct 6 15:27:53 galassia systemd-logind[5591]: User of session c2 not known..Oct 6 15:27:53 galassia systemd-logind[5591]: User of session 2 not known..Oct 6 15:27:53 galassia systemd-logind[5591]: Session enumeration failed: No such file or directory.Oct 6 15:27:53 galassia systemd-logind[5591]: Watching system buttons on /dev/input/event0 (Power Button).Oct 6 15:27:53 galassia systemd-logind[5591]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Oct 6 15:27:53 galassia systemd-logind[5591]: New seat seat0..Oct 6 15:27:53 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' kno

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42947
Entropy (8bit):	4.718817844821948
Encrypted:	false
SSDEEP:	384:q+MM2IHcoo/2k9vmPRHpimOBKzd5fpGjVa/d8H1OF5qlgnCzIqEz:q+MM2IHcoodmPi2nG+
MD5:	E36CCF7356BE1B42FCD63B76006D906A
SHA1:	17D25EEBB0A6A08E265ED8A3678475A39CB19E12
SHA-256:	08064AF0CA0B0AC1F0B0BB2715FF187C0B2F503C71043B88848163533CC92EE0
SHA-512:	11090F3548DEE2ED30B616E1DF4CB088C635B2ACD51D78504D584AE8B423904FABB99F05362E8172816ECD78C53C9AFCA45DB278FC80F188D515652C092A4021
Malicious:	false
Preview:	Oct 6 15:27:51 galassia kernel: [ 156.372207] blocking signal 9: 5525 -> 933.Oct 6 15:27:51 galassia kernel: [ 156.412705] blocking signal 9: 5525 -> 1333.Oct 6 15:27:51 galassia kernel: [ 156.676903] blocking signal 9: 5525 -> 1617.Oct 6 15:27:51 galassia kernel: [ 156.868920] blocking signal 9: 5531 -> 658.Oct 6 15:27:51 galassia kernel: [ 157.055007] blocking signal 9: 5525 -> 3157.Oct 6 15:27:51 galassia kernel: [ 157.172375] blocking signal 9: 5531 -> 723.Oct 6 15:27:51 galassia kernel: [ 157.250048] blocking signal 9: 5525 -> 3220.Oct 6 15:27:51 galassia kernel: [ 157.381482] blocking signal 9: 5531 -> 777.Oct 6 15:27:51 galassia kernel: [ 157.558625] blocking signal 9: 5531 -> 933.Oct 6 15:27:51 galassia kernel: [ 157.689566] blocking signal 9: 5531 -> 1333.Oct 6 15:27:51 galassia kernel: [ 157.990022] blocking signal 9: 5531 -> 1617.Oct 6 15:27:51 galassia kernel: [ 158.200107] New task spawned: old: (tgid 5574, tid 5574), new (tgid: 5574, tid: 5583).Oct

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	152160
Entropy (8bit):	5.214234944273971
Encrypted:	false
SSDEEP:	768:RdZvBifRClCIIsalmzPpom68ig8+GO+Hcoos1przJlTTm5PSNcQG6+LBeqAF9L/f:5ym5PSTHSVoCKUggQ80
MD5:	0CB97CC5F7C4847424E8EA2208609586
SHA1:	E8B8205007F459A9C6774777CF28B59E67851CD0
SHA-256:	5F67C62ADDC5CE2118AD620FBBDBD7E29307275A4530528EAB05AF7623DE3558
SHA-512:	2AD7809EA9AFFC5728D24E4F3C13371D49B6A4BC54B5A0CF3DBBB5720354D4C8073CE6F4FD7EE254656C49B3B14EE2A1409D87F536E7C85ACBC6985E9C0E1BC0
Malicious:	false
Preview:	Oct 6 15:27:49 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:27:49 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 6 15:27:49 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 6 15:27:49 galassia systemd[1]: Stopped System Logging Service..Oct 6 15:27:49 galassia systemd[1]: Starting System Logging Service....Oct 6 15:27:49 galassia systemd[3044]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 6 15:27:49 galassia systemd[3044]: Stopped Sound Service..Oct 6 15:27:49 galassia systemd[3044]: Starting Sound Service....Oct 6 15:27:50 galassia systemd[1431]: dbus.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:27:50 galassia systemd[1431]: dbus.service: Failed with result 'signal'..Oct 6 15:27:50 galassia multipathd[658]: sda: add missing path.Oct 6 15:27:50 galassia multipathd[658]: sda: failed to get udev uid: Invalid argumen

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6670868467684751
Encrypted:	false
SSDEEP:	3:xs1sXlXEWtl/Fh:qQ+yl
MD5:	E53C58800AF4AECE13919772287B6EAD
SHA1:	5FC4C56FF741B5F336319C52EA3954FC86164A81
SHA-256:	08621F01D09251A01FF2D21564F99DCDA34F33C64A6D6BDC74B607C3843CF648
SHA-512:	D4193AF5C4BE2C1C864C9FFB9903F763537CACD351865C5E413AC4E54A17EF0129BC7D14FEDC5A684A8C9E8B5C65462D89D11A402EF7AF9722D8D61B7883A1CC
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g.D......................................

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.990696409819013
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	145'612 bytes
MD5:	cec8e5b6a9341c75d85623039d061000
SHA1:	d21caee1c8c53559cc4d810e7e56b0bce4a883e5
SHA256:	9b77d6b60b0b175dd125e11b95dac1fde38deaba01c75c544fa3b5d44bc7d93a
SHA512:	658f752708ac13d30ec3235c213a0171ea7887a766d2939f459a89155e24ef6fba10517562a2a2c17fe2f5f68afe13fe7b9169f06d43c2b26e90afe0ff66bbae
SSDEEP:	3072:Qw3GlHqPZhnDOa2aNSSWj75i2Vbxg5Auj255M/91SdaTjH+:r3SHqxdOa2aNSS0NpcRj23M/91caXH+
TLSH:	B8E33B56EA814B13C0D6177ABAAF424533239B64D3DB73069928BFF43F8675E0E23605
File Content Preview:	.ELF..............(.........4...........4. ...(........p.R...........................................S...S...............S...S...S..X....3...............S...S...S..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	114320
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x13b64	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1bc54	0x13c54	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1bc68	0x13c68	0x1640	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1d2a8	0x152a8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1d2c0	0x152c0	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x253d8	0x153d8	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x253dc	0x153dc	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x253dc	0x153dc	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x253e0	0x153e0	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x253e4	0x153e4	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x253e8	0x153e8	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x25490	0x15490	0x2a0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x25730	0x15730	0x3064	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x15730	0xad8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x16208	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x16348	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1655b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1859e	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x18c80	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19af8	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x19db0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1a67a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1b809	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1bd61	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1bd77	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1c318	0x4d80	0x10	0x0		28	702	4
.strtab	STRTAB	0x0	0x21098	0x2834	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x152c0	0x1d2c0	0x1d2c0	0x118	0x118	4.4148	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x153d8	0x153d8	6.1251	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x153d8	0x253d8	0x253d8	0x358	0x33bc	3.5292	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x153dc	0x253dc	0x253dc	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 22:27:46.897355080 CEST	192.168.2.15	8.8.8.8	0x1528	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:27:48.006849051 CEST	192.168.2.15	8.8.8.8	0x28a3	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:27:52.174241066 CEST	192.168.2.15	8.8.8.8	0x46d5	Standard query (0)	byte-mirai.kro.kr	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 22:27:46.919050932 CEST	8.8.8.8	192.168.2.15	0x1528	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:27:48.014225960 CEST	8.8.8.8	192.168.2.15	0x28a3	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false
Oct 6, 2024 22:27:52.413710117 CEST	8.8.8.8	192.168.2.15	0x46d5	No error (0)	byte-mirai.kro.kr	154.216.20.119	A (IP address)	IN (0x0001)	false

Start time (UTC):	20:27:46
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:27:49
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:50
Start date (UTC):	06/10/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	20:27:53
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:54
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:27:55
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:27:56
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:27:57
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:27:58
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:27:59
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:28:00
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:28:10
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:28:13
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:28:16
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5727/oom_score_adj

/proc/5730/oom_score_adj

/proc/5732/oom_score_adj

/proc/5734/oom_score_adj

/proc/5736/oom_score_adj

/proc/5738/oom_score_adj

/proc/5741/oom_score_adj

/proc/5813/oom_score_adj

/proc/5843/oom_score_adj

/proc/5846/oom_score_adj

/proc/5848/oom_score_adj

/proc/5850/oom_score_adj

/proc/5852/oom_score_adj

/proc/5854/oom_score_adj

/proc/5857/oom_score_adj

/proc/6039/oom_score_adj

/proc/6197/oom_score_adj

/proc/6214/oom_score_adj

/proc/6438/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1jCgqqW

/run/systemd/inhibit/.#2JzQzWZ

/run/systemd/inhibit/.#3XO2naW

/run/systemd/inhibit/.#4wOMjRX

/run/systemd/seats/.#seat0HA3C8W

Linux Analysis Report
na.elf

Start time (UTC):	20:28:17
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	20:28:18
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:28:19
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:28:23
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:28:26
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:28:27
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	/usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:28:42
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:29:12
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:28:47
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	20:28:53
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c