Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527311
MD5:	ee5ef9ca3a25d54b970c21a46569f1cb
SHA1:	370c7639e7b39e92ffbe37a0ac0d74d5dfdd5cf0
SHA256:	85516b9359150eaaa42f40bdc50b4fc8bb1f88ac6a834587a00c7399e7241152
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527311
Start date and time:	2024-10-06 22:28:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/100@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Process Tree

system is lnxubuntu20

na.elf (PID: 5432, Parent: 5357, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5435, Parent: 5432)

na.elf New Fork (PID: 5437, Parent: 5432)

na.elf New Fork (PID: 5439, Parent: 5432)

na.elf New Fork (PID: 5441, Parent: 5439)

na.elf New Fork (PID: 5443, Parent: 5439)

na.elf New Fork (PID: 5444, Parent: 5439)

na.elf New Fork (PID: 5447, Parent: 5439)

na.elf New Fork (PID: 5449, Parent: 5439)

gdm3 New Fork (PID: 5478, Parent: 1400)

Default (PID: 5478, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5482, Parent: 1)

dbus-daemon (PID: 5482, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5483, Parent: 1)

rsyslogd (PID: 5483, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5484, Parent: 2935)

pulseaudio (PID: 5484, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 5485, Parent: 1400)

Default (PID: 5485, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5486, Parent: 1400)

Default (PID: 5486, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 5487, Parent: 3122)

fusermount (PID: 5487, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5498, Parent: 1)

rtkit-daemon (PID: 5498, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 5501, Parent: 1)

systemd-logind (PID: 5501, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5560, Parent: 1)

polkitd (PID: 5560, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 5564, Parent: 1)

gpu-manager (PID: 5564, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5566, Parent: 5564)

sh (PID: 5566, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5567, Parent: 5566)

grep (PID: 5567, Parent: 5566, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5568, Parent: 5564)

sh (PID: 5568, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5569, Parent: 5568)

grep (PID: 5569, Parent: 5568, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5570, Parent: 5564)

sh (PID: 5570, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5571, Parent: 5570)

grep (PID: 5571, Parent: 5570, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5572, Parent: 5564)

sh (PID: 5572, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5573, Parent: 5572)

grep (PID: 5573, Parent: 5572, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5574, Parent: 5564)

sh (PID: 5574, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5575, Parent: 5574)

grep (PID: 5575, Parent: 5574, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5576, Parent: 5564)

sh (PID: 5576, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5577, Parent: 5576)

grep (PID: 5577, Parent: 5576, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5578, Parent: 5564)

sh (PID: 5578, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5579, Parent: 5578)

grep (PID: 5579, Parent: 5578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5582, Parent: 5564)

sh (PID: 5582, Parent: 5564, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5583, Parent: 5582)

grep (PID: 5583, Parent: 5582, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5565, Parent: 1)

agetty (PID: 5565, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 5586, Parent: 1)

generate-config (PID: 5586, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5588, Parent: 5586)

pkill (PID: 5588, Parent: 5586, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5591, Parent: 1)

gdm-wait-for-drm (PID: 5591, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 5596, Parent: 1)

gdm3 (PID: 5596, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 5601, Parent: 5596)

plymouth (PID: 5601, Parent: 5596, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 5620, Parent: 5596)

gdm-session-worker (PID: 5620, Parent: 5596, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5626, Parent: 5620)

gdm-wayland-session (PID: 5626, Parent: 5620, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 5630, Parent: 5626)

dbus-run-session (PID: 5630, Parent: 5626, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5631, Parent: 5630)

dbus-daemon (PID: 5631, Parent: 5630, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5635, Parent: 5631)

dbus-daemon New Fork (PID: 5636, Parent: 5635)

false (PID: 5636, Parent: 5635, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5638, Parent: 5631)

dbus-daemon New Fork (PID: 5639, Parent: 5638)

false (PID: 5639, Parent: 5638, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5640, Parent: 5631)

dbus-daemon New Fork (PID: 5641, Parent: 5640)

false (PID: 5641, Parent: 5640, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5642, Parent: 5631)

dbus-daemon New Fork (PID: 5643, Parent: 5642)

false (PID: 5643, Parent: 5642, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5644, Parent: 5631)

dbus-daemon New Fork (PID: 5645, Parent: 5644)

false (PID: 5645, Parent: 5644, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5646, Parent: 5631)

dbus-daemon New Fork (PID: 5647, Parent: 5646)

false (PID: 5647, Parent: 5646, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5649, Parent: 5631)

dbus-daemon New Fork (PID: 5650, Parent: 5649)

false (PID: 5650, Parent: 5649, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5632, Parent: 5630)

gnome-session (PID: 5632, Parent: 5630, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5632, Parent: 5630, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5653, Parent: 5632)

session-migration (PID: 5653, Parent: 5632, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5654, Parent: 5632)

sh (PID: 5654, Parent: 5632, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5654, Parent: 5632, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gdm3 New Fork (PID: 5678, Parent: 5596)

gdm-session-worker (PID: 5678, Parent: 5596, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 5688, Parent: 5678)

gdm-x-session (PID: 5688, Parent: 5678, MD5: 498a824333f1c1ec7767f4612d1887cc) Arguments: /usr/lib/gdm3/gdm-x-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-x-session New Fork (PID: 5690, Parent: 5688)

Xorg (PID: 5690, Parent: 5688, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg.wrap (PID: 5690, Parent: 5688, MD5: 48993830888200ecf19dd7def0884dfd) Arguments: /usr/lib/xorg/Xorg.wrap vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg (PID: 5690, Parent: 5688, MD5: 730cf4c45a7ee8bea88abf165463b7f8) Arguments: /usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3

Xorg New Fork (PID: 5702, Parent: 5690)

sh (PID: 5702, Parent: 5690, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5703, Parent: 5702)

xkbcomp (PID: 5703, Parent: 5702, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

Xorg New Fork (PID: 5952, Parent: 5690)

sh (PID: 5952, Parent: 5690, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5953, Parent: 5952)

xkbcomp (PID: 5953, Parent: 5952, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

gdm-x-session New Fork (PID: 5708, Parent: 5688)

Default (PID: 5708, Parent: 5688, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/Prime/Default

gdm-x-session New Fork (PID: 5709, Parent: 5688)

dbus-run-session (PID: 5709, Parent: 5688, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 5710, Parent: 5709)

dbus-daemon (PID: 5710, Parent: 5709, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

dbus-daemon New Fork (PID: 5726, Parent: 5710)

dbus-daemon New Fork (PID: 5727, Parent: 5726)

at-spi-bus-launcher (PID: 5727, Parent: 5726, MD5: 1563f274acd4e7ba530a55bdc4c95682) Arguments: /usr/libexec/at-spi-bus-launcher

at-spi-bus-launcher New Fork (PID: 5732, Parent: 5727)

dbus-daemon (PID: 5732, Parent: 5727, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 3

dbus-daemon New Fork (PID: 6108, Parent: 5732)

dbus-daemon New Fork (PID: 6109, Parent: 6108)

at-spi2-registryd (PID: 6109, Parent: 6108, MD5: 1d904c2693452edebc7ede3a9e24d440) Arguments: /usr/libexec/at-spi2-registryd --use-gnome-session

dbus-daemon New Fork (PID: 5754, Parent: 5710)

dbus-daemon New Fork (PID: 5755, Parent: 5754)

false (PID: 5755, Parent: 5754, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5757, Parent: 5710)

dbus-daemon New Fork (PID: 5758, Parent: 5757)

false (PID: 5758, Parent: 5757, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5761, Parent: 5710)

dbus-daemon New Fork (PID: 5762, Parent: 5761)

false (PID: 5762, Parent: 5761, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5763, Parent: 5710)

dbus-daemon New Fork (PID: 5764, Parent: 5763)

false (PID: 5764, Parent: 5763, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5765, Parent: 5710)

dbus-daemon New Fork (PID: 5766, Parent: 5765)

false (PID: 5766, Parent: 5765, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5767, Parent: 5710)

dbus-daemon New Fork (PID: 5768, Parent: 5767)

false (PID: 5768, Parent: 5767, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5770, Parent: 5710)

dbus-daemon New Fork (PID: 5771, Parent: 5770)

false (PID: 5771, Parent: 5770, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-daemon New Fork (PID: 5948, Parent: 5710)

dbus-daemon New Fork (PID: 5949, Parent: 5948)

ibus-portal (PID: 5949, Parent: 5948, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

dbus-daemon New Fork (PID: 6126, Parent: 5710)

dbus-daemon New Fork (PID: 6127, Parent: 6126)

gjs (PID: 6127, Parent: 6126, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

dbus-daemon New Fork (PID: 6356, Parent: 5710)

dbus-daemon New Fork (PID: 6357, Parent: 6356)

false (PID: 6357, Parent: 6356, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

dbus-run-session New Fork (PID: 5711, Parent: 5709)

gnome-session (PID: 5711, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: gnome-session --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary (PID: 5711, Parent: 5709, MD5: d9b90be4f7db60cb3c2d3da6a1d31bfb) Arguments: /usr/libexec/gnome-session-binary --systemd --autostart /usr/share/gdm/greeter/autostart

gnome-session-binary New Fork (PID: 5714, Parent: 5711)

gnome-session-check-accelerated (PID: 5714, Parent: 5711, MD5: a64839518af85b2b9de31aca27646396) Arguments: /usr/libexec/gnome-session-check-accelerated

gnome-session-check-accelerated New Fork (PID: 5733, Parent: 5714)

gnome-session-check-accelerated-gl-helper (PID: 5733, Parent: 5714, MD5: b1ab9a384f9e98a39ae5c36037dd5e78) Arguments: /usr/libexec/gnome-session-check-accelerated-gl-helper --print-renderer

gnome-session-check-accelerated New Fork (PID: 5743, Parent: 5714)

gnome-session-check-accelerated-gles-helper (PID: 5743, Parent: 5714, MD5: 1bd78885765a18e60c05ed1fb5fa3bf8) Arguments: /usr/libexec/gnome-session-check-accelerated-gles-helper --print-renderer

gnome-session-binary New Fork (PID: 5772, Parent: 5711)

session-migration (PID: 5772, Parent: 5711, MD5: 5227af42ebf14ac2fe2acddb002f68dc) Arguments: session-migration

gnome-session-binary New Fork (PID: 5773, Parent: 5711)

sh (PID: 5773, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5773, Parent: 5711, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5941, Parent: 5773)

ibus-daemon (PID: 5941, Parent: 5773, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5944, Parent: 5941)

ibus-memconf (PID: 5944, Parent: 5941, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5946, Parent: 5941)

ibus-daemon New Fork (PID: 5947, Parent: 5946)

ibus-x11 (PID: 5947, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 6171, Parent: 5941)

ibus-engine-simple (PID: 6171, Parent: 5941, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

gnome-session-binary New Fork (PID: 6143, Parent: 5711)

sh (PID: 6143, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6143, Parent: 5711, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 6145, Parent: 5711)

sh (PID: 6145, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6145, Parent: 5711, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6148, Parent: 5711)

sh (PID: 6148, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6148, Parent: 5711, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6155, Parent: 5711)

sh (PID: 6155, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6155, Parent: 5711, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6156, Parent: 5711)

sh (PID: 6156, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6156, Parent: 5711, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6348, Parent: 6156)

gsd-print-notifications New Fork (PID: 6350, Parent: 6348)

gsd-printer (PID: 6350, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 6157, Parent: 5711)

sh (PID: 6157, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6157, Parent: 5711, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 6158, Parent: 5711)

sh (PID: 6158, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6158, Parent: 5711, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6160, Parent: 5711)

sh (PID: 6160, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6160, Parent: 5711, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 6161, Parent: 5711)

sh (PID: 6161, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6161, Parent: 5711, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 6163, Parent: 5711)

sh (PID: 6163, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6163, Parent: 5711, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 6164, Parent: 5711)

sh (PID: 6164, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6164, Parent: 5711, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 6166, Parent: 5711)

sh (PID: 6166, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6166, Parent: 5711, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 6169, Parent: 5711)

sh (PID: 6169, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6169, Parent: 5711, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6176, Parent: 5711)

sh (PID: 6176, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6176, Parent: 5711, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 6596, Parent: 5711)

sh (PID: 6596, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/spice-vdagent

spice-vdagent (PID: 6596, Parent: 5711, MD5: 80fb7f613aa78d1b8a229dbcf4577a9d) Arguments: /usr/bin/spice-vdagent

gnome-session-binary New Fork (PID: 6609, Parent: 5711)

sh (PID: 6609, Parent: 5711, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh xbrlapi -q

xbrlapi (PID: 6609, Parent: 5711, MD5: 0cfe25df39d38af32d6265ed947ca5b9) Arguments: xbrlapi -q

gdm3 New Fork (PID: 5679, Parent: 5596)

Default (PID: 5679, Parent: 5596, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5680, Parent: 5596)

Default (PID: 5680, Parent: 5596, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5602, Parent: 1)

accounts-daemon (PID: 5602, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5615, Parent: 5602)

language-validate (PID: 5615, Parent: 5602, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5616, Parent: 5615)

language-options (PID: 5616, Parent: 5615, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5617, Parent: 5616)

sh (PID: 5617, Parent: 5616, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5618, Parent: 5617)

locale (PID: 5618, Parent: 5617, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5619, Parent: 5617)

grep (PID: 5619, Parent: 5617, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5628, Parent: 1410)

dbus-daemon (PID: 5628, Parent: 1410, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5795, Parent: 1)

systemd-localed (PID: 5795, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 5959, Parent: 1)

upowerd (PID: 5959, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 5997, Parent: 1410)

pulseaudio (PID: 5997, Parent: 1410, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6002, Parent: 1)

geoclue (PID: 6002, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

systemd New Fork (PID: 6113, Parent: 2935)

dbus-daemon (PID: 6113, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6120, Parent: 1)

wpa_supplicant (PID: 6120, Parent: 1, MD5: 2a5acf2a7a908a1388a09991ed7881e1) Arguments: /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

systemd New Fork (PID: 6121, Parent: 1)

avahi-daemon (PID: 6121, Parent: 1, MD5: 0125e88392fec809934928f8638511ff) Arguments: /usr/sbin/avahi-daemon -s

avahi-daemon New Fork (PID: 6123, Parent: 6121)

systemd New Fork (PID: 6124, Parent: 1)

packagekitd (PID: 6124, Parent: 1, MD5: 46b0c31f013b71a0eb63b1c040f11c86) Arguments: /usr/lib/packagekit/packagekitd

packagekitd New Fork (PID: 6149, Parent: 6124)

dpkg (PID: 6149, Parent: 6124, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: /usr/bin/dpkg --print-foreign-architectures

systemd New Fork (PID: 6128, Parent: 2935)

pulseaudio (PID: 6128, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6202, Parent: 1)

systemd-hostnamed (PID: 6202, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

systemd New Fork (PID: 6381, Parent: 1)

ModemManager (PID: 6381, Parent: 1, MD5: 24379bf705a8ff3b2379314585843d4f) Arguments: /usr/sbin/ModemManager --filter-policy=strict

systemd New Fork (PID: 6433, Parent: 1)

colord (PID: 6433, Parent: 1, MD5: 70861d1b2818c9279cd4a5c9035dac1f) Arguments: /usr/libexec/colord

colord New Fork (PID: 6600, Parent: 6433)

colord-sane (PID: 6600, Parent: 6433, MD5: 5f98d754a07bf1385c3ff001cde3882e) Arguments: /usr/libexec/colord-sane

systemd New Fork (PID: 6449, Parent: 1)

systemd-localed (PID: 6449, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

systemd New Fork (PID: 6622, Parent: 1)

fprintd (PID: 6622, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5432	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5432	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5435	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5435	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5437	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5437	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5439	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5439	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5441	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5443	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5443	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 18 entries

String: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: global traffic

TCP traffic: 192.168.2.13:37402 -> 154.216.20.119:777

Source: /usr/sbin/rsyslogd (PID: 5483)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5596)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5631)	Socket: unknown address family	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5632)	Socket: unknown address family	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5710)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 5732)	Socket: unknown address family
Source: /usr/libexec/gnome-session-binary (PID: 5711)	Socket: unknown address family
Source: /usr/bin/ibus-daemon (PID: 5941)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 168.157.238.88
Source: unknown	TCP traffic detected without corresponding DNS query: 123.197.196.92
Source: unknown	TCP traffic detected without corresponding DNS query: 158.67.222.110
Source: unknown	TCP traffic detected without corresponding DNS query: 133.13.158.88
Source: unknown	TCP traffic detected without corresponding DNS query: 150.249.98.246
Source: unknown	TCP traffic detected without corresponding DNS query: 37.96.47.57
Source: unknown	TCP traffic detected without corresponding DNS query: 38.32.17.48
Source: unknown	TCP traffic detected without corresponding DNS query: 75.180.52.162
Source: unknown	TCP traffic detected without corresponding DNS query: 176.224.253.86
Source: unknown	TCP traffic detected without corresponding DNS query: 113.34.158.61
Source: unknown	TCP traffic detected without corresponding DNS query: 203.251.0.163
Source: unknown	TCP traffic detected without corresponding DNS query: 42.158.124.227
Source: unknown	TCP traffic detected without corresponding DNS query: 151.165.142.111
Source: unknown	TCP traffic detected without corresponding DNS query: 90.29.81.148
Source: unknown	TCP traffic detected without corresponding DNS query: 9.55.118.146
Source: unknown	TCP traffic detected without corresponding DNS query: 78.116.73.174
Source: unknown	TCP traffic detected without corresponding DNS query: 209.31.170.248
Source: unknown	TCP traffic detected without corresponding DNS query: 17.108.239.25
Source: unknown	TCP traffic detected without corresponding DNS query: 148.151.28.87
Source: unknown	TCP traffic detected without corresponding DNS query: 154.98.252.172
Source: unknown	TCP traffic detected without corresponding DNS query: 169.219.66.56
Source: unknown	TCP traffic detected without corresponding DNS query: 207.180.108.126
Source: unknown	TCP traffic detected without corresponding DNS query: 18.127.152.216
Source: unknown	TCP traffic detected without corresponding DNS query: 48.191.15.186
Source: unknown	TCP traffic detected without corresponding DNS query: 18.99.155.207
Source: unknown	TCP traffic detected without corresponding DNS query: 212.3.73.65
Source: unknown	TCP traffic detected without corresponding DNS query: 52.0.80.8
Source: unknown	TCP traffic detected without corresponding DNS query: 202.112.203.238
Source: unknown	TCP traffic detected without corresponding DNS query: 111.205.187.235
Source: unknown	TCP traffic detected without corresponding DNS query: 98.122.231.157
Source: unknown	TCP traffic detected without corresponding DNS query: 105.73.44.21
Source: unknown	TCP traffic detected without corresponding DNS query: 18.65.168.17
Source: unknown	TCP traffic detected without corresponding DNS query: 92.78.16.32
Source: unknown	TCP traffic detected without corresponding DNS query: 18.150.127.41
Source: unknown	TCP traffic detected without corresponding DNS query: 137.188.213.172
Source: unknown	TCP traffic detected without corresponding DNS query: 46.63.219.34
Source: unknown	TCP traffic detected without corresponding DNS query: 109.57.160.40
Source: unknown	TCP traffic detected without corresponding DNS query: 19.4.70.112
Source: unknown	TCP traffic detected without corresponding DNS query: 198.114.246.115
Source: unknown	TCP traffic detected without corresponding DNS query: 68.119.93.208
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.227.33
Source: unknown	TCP traffic detected without corresponding DNS query: 62.162.225.87
Source: unknown	TCP traffic detected without corresponding DNS query: 19.77.162.157
Source: unknown	TCP traffic detected without corresponding DNS query: 67.150.169.202
Source: unknown	TCP traffic detected without corresponding DNS query: 44.212.141.67
Source: unknown	TCP traffic detected without corresponding DNS query: 140.133.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 27.112.165.55
Source: unknown	TCP traffic detected without corresponding DNS query: 4.82.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 107.119.85.1
Source: unknown	TCP traffic detected without corresponding DNS query: 92.29.2.140

Source: global traffic

DNS traffic detected: DNS query: byte-mirai.kro.kr

Source: syslog.26.dr, Xorg.0.log.149.dr	String found in binary or memory: http://wiki.x.org
Source: syslog.26.dr, Xorg.0.log.149.dr	String found in binary or memory: http://www.ubuntu.com/support)
Source: syslog.26.dr	String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5435, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5441, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 5726, result: successful
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 5948, result: successful
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 6126, result: successful
Source: /usr/bin/dbus-daemon (PID: 5732)	SIGKILL sent: pid: 6108, result: successful

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: byte/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraarmx86dbgmipsmpslbot/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homemipselarm4arm5arm6arm7sh4m68kx586x86_64i586i686ppcspcbyte-mirai.kro.kr68.183.18.151

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5435)	SIGKILL sent: pid: 5435, result: unknown	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3442, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 3712, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5439, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	SIGKILL sent: pid: 5441, result: unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 5726, result: successful
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 5948, result: successful
Source: /usr/bin/dbus-daemon (PID: 5710)	SIGKILL sent: pid: 6126, result: successful
Source: /usr/bin/dbus-daemon (PID: 5732)	SIGKILL sent: pid: 6108, result: successful

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/100@1/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5482)	File: /proc/5482/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5487)	File: /proc/5487/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5631)	File: /proc/5631/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5710)	File: /proc/5710/mounts
Source: /usr/bin/dbus-daemon (PID: 5732)	File: /proc/5732/mounts
Source: /usr/bin/gjs (PID: 6127)	File: /proc/6127/mounts
Source: /usr/bin/gnome-shell (PID: 5773)	File: /proc/5773/mounts
Source: /usr/bin/dbus-daemon (PID: 5628)	File: /proc/5628/mounts
Source: /usr/bin/dbus-daemon (PID: 6113)	File: /proc/6113/mounts

Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0TYGbqa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127F98YF9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127zwYQX8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1gvE507	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127U6Amma	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat07tYIw9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#1278nql99	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c13SWrZb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1bIvnEa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127KBW7ib	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0mFJVk8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1pna857	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#1270O1UIb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c15BBu3a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c13PIu78	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c1ROBcx8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127nzGKF9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (20)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (19)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0XfsMoa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127A6Ya4b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0Gyn9jc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127F3CQUb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0IOlOu9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127ePhMY9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2oBHUra	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127UQfBh8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/seats/.#seat0wZMV37	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c26MZpqb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2K1Bdh9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/users/.#127nC8kOb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2Tudltb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c24eZGr9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (21)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2fwmwAb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (22)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c2KanZda	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (24)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	Directory: <invalid fd (23)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/sessions/.#c22l2cLb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#1XdzvZa	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#2qzKwab	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#3EN7mab	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5501)	File: /run/systemd/inhibit/.#4vlhGUb	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	Directory: /root/.cache	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5654)	Directory: <invalid fd (11)>/..	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5654)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Directory: <invalid fd (23)>/..
Source: /usr/lib/xorg/Xorg (PID: 5690)	Directory: <invalid fd (22)>/..
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5714)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5714)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5714)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5733)	Directory: /var/lib/gdm3/.drirc
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5743)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5743)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5743)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: /var/lib/gdm3/.drirc
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: <invalid fd (12)>/..
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: <invalid fd (11)>/..
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: <invalid fd (14)>/..
Source: /usr/bin/gnome-shell (PID: 5773)	Directory: <invalid fd (13)>/..
Source: /usr/libexec/ibus-x11 (PID: 5947)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/ibus-x11 (PID: 5947)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-wacom (PID: 6145)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-wacom (PID: 6145)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-color (PID: 6148)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-color (PID: 6148)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-keyboard (PID: 6155)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-keyboard (PID: 6155)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-rfkill (PID: 6157)	Directory: <invalid fd (9)>/..
Source: /usr/libexec/gsd-rfkill (PID: 6157)	Directory: <invalid fd (8)>/..
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo
Source: /usr/libexec/gsd-power (PID: 6176)	Directory: /var/lib/gdm3/.Xdefaults
Source: /usr/libexec/gsd-power (PID: 6176)	Directory: /var/lib/gdm3/.Xdefaults-galassia
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5602)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5602)	Directory: /root/.cache
Source: /usr/lib/upower/upowerd (PID: 5959)	Directory: <invalid fd (12)>/..
Source: /usr/lib/upower/upowerd (PID: 5959)	Directory: <invalid fd (11)>/..
Source: /usr/lib/packagekit/packagekitd (PID: 6124)	Directory: /root/.cache
Source: /lib/systemd/systemd-hostnamed (PID: 6202)	Directory: <invalid fd (10)>/..
Source: /usr/sbin/ModemManager (PID: 6381)	Directory: <invalid fd (12)>/..
Source: /usr/sbin/ModemManager (PID: 6381)	Directory: <invalid fd (11)>/..
Source: /usr/libexec/colord (PID: 6433)	Directory: /var/lib/colord/.cache

Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5482/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5482/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5560/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6155/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5484/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5484/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5484/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6176/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6157/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6157/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6156/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5620/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5620/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6433/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5959/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5632/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5654/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6128/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6128/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6600/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6622/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5678/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5678/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5711/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5997/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5997/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5997/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6449/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5690/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6120/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6121/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6143/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6124/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5596/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6002/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6002/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5773/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5795/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6148/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6202/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6381/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/6161/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5688/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5602/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5482)	File opened: /proc/5626/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6155/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6155/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5484/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5484/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5484/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6176/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6176/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/cmdline	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5773/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6148/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6148/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6161/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6161/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/1/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6128/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6128/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/6128/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/status	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5997/cgroup	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5711/stat	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 5560)	File opened: /proc/5711/cgroup	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5441)	File opened: /proc/14/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5566)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5568)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5570)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5572)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5574)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5576)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5578)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5582)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5702)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/lib/xorg/Xorg (PID: 5952)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
Source: /usr/share/language-tools/language-options (PID: 5617)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 5567)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5569)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5573)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5575)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5577)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5579)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5583)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5619)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 5588)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 5565)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 5596)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 5596)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5602)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5602)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 5483)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 5564)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/lib/xorg/Xorg (PID: 5690)	Log file created: /var/log/Xorg.0.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5564)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Truncated file: /var/log/Xorg.pid-5690.log

Source: /usr/bin/pulseaudio (PID: 5484)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5588)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5690)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5714)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5733)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5743)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/gnome-shell (PID: 5773)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5997)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6128)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/na.elf (PID: 5432)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5484)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5564)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 5565)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5620)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5632)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5678)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-x-session (PID: 5688)	Queries kernel information via 'uname':
Source: /usr/lib/xorg/Xorg (PID: 5690)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi-bus-launcher (PID: 5727)	Queries kernel information via 'uname':
Source: /usr/libexec/at-spi2-registryd (PID: 6109)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-binary (PID: 5711)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5714)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5733)	Queries kernel information via 'uname':
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5743)	Queries kernel information via 'uname':
Source: /usr/bin/gnome-shell (PID: 5773)	Queries kernel information via 'uname':
Source: /usr/libexec/ibus-x11 (PID: 5947)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-wacom (PID: 6145)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-color (PID: 6148)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-keyboard (PID: 6155)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-smartcard (PID: 6158)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-media-keys (PID: 6161)	Queries kernel information via 'uname':
Source: /usr/libexec/gsd-power (PID: 6176)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5997)	Queries kernel information via 'uname':
Source: /usr/sbin/avahi-daemon (PID: 6121)	Queries kernel information via 'uname':
Source: /usr/lib/packagekit/packagekitd (PID: 6124)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6128)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6202)	Queries kernel information via 'uname':
Source: /usr/libexec/colord-sane (PID: 6600)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6622)	Queries kernel information via 'uname':

Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.641] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.grn: 8
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.601] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.509] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.476] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.459] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.525] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.687] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.356] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.909] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.822] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.960] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.369] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.666] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.252] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.440] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.047] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.067] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.830] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using HW cursor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.414] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.191] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.614] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.072] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.513] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.220] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.721] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.927] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.086] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.754] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.427] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.018] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.400] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.192] (II) LoadModule: "vmware"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.900] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.412] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.157] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.421] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.628] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.296] (--) vmware(0): depth: 24
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.313] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.542] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.884] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.051] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.382] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.645] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.664] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.003] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:21 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.180] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.308] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.391] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.128] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.936] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.016] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.575] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: na.elf, 5435.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.L4ykq8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.956] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.309] (--) vmware(0): pbase: 0xe8000000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.966] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.623] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.333] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.983] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.727] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.904] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.809] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.781] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.538] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.659] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.870] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.875] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.437] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.991] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.623] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.987] (==) vmware(0): Silken mouse enabled
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.241] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.582] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.686] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling 3D support.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.361] (==) vmware(0): Using HW cursor
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.826] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.600] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.858] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.833] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.913] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.517] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.651] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.951] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.587] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.607] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.450] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.763] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.149] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.817] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: na.elf, 5441.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.WhL1cB
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.487] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.829] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.045] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.970] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: na.elf, 5432.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5435.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5437.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5439.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5441.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5443.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.911] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.798] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.326] (--) vmware(0): bpp: 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.936] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.468] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.388] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.909] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: na.elf, 5435.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.L4ykq8h{
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.851] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.799] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.765] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.403] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.818] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.519] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:20 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) LoadModule: "vmware"
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.blu: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.434] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.810] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.198] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.922] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: na.elf, 5432.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5439.1.00005616cb209000.00005616cb2b9000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): caps: 0xFDFF83E2
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.409] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.173] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.999] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.231] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.079] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.381] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.551] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.412] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.002] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.166] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.268] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.168] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.373] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.847] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.893] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.365] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.974] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:20 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.343] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.484] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.672] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.007] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.121] (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.198] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.096] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.449] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.862] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.445] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.488] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.326] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.529] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 5 times: [ (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.123] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.637] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.650] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.260] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.844] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.590] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.395] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.305] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.114] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.562] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.566] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.107] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.806] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.397] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.214] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.771] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.178] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.457] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xinerama extension.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.947] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.032] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.342] (--) vmware(0): vis: 4
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.514] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.574] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.011] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: na.elf, 5435.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5437.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5441.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5443.1.00005616cb209000.00005616cb2b9000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.880] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.596] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.803] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.322] (--) vmware(0): depth: 24
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.028] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.660] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.338] (--) vmware(0): w.blu: 8
Source: na.elf, 5441.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.WhL1cBh{
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.418] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.553] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.377] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.978] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.157] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.669] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.424] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: na.elf, 5432.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5435.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5437.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5439.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5441.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp, na.elf, 5443.1.00007ffd40d9a000.00007ffd40dbb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.837] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.176] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 3 times: [ (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)]
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.025] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.611] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.425] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.786] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:20 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.895] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.074] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.141] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.428] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.059] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.132] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.221] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.510] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.317] (--) vmware(0): mheig: 885
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.973] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.045] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.880] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.973] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.183] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.745] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.710] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.925] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.280] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.750] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.531] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.700] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.841] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:20 galassia /usr/lib/gdm3/gdm-x-session[5690]: (==) Matched vmware as autoconfigured driver 0
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.842] (EE) vmware(0): Failed to open drm.
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.403] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.346] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.892] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.745] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.668] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.472] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.363] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.289] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.682] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): vis: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.087] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.624] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.496] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.138] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.453] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.547] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.480] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.941] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.504] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.584] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.767] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.300] (--) vmware(0): bpp: 32
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:21 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.294] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.815] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.370] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.591] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.947] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.921] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:28 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.888] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.334] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.461] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.959] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.739] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.854] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.920] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.372] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.384] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.498] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.114] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.420] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.987] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.967] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.024] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.570] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.037] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.064] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.826] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.476] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.558] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.533] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.990] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.431] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.565] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.603] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.775] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.117] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.866] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.139] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.781] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.861] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.731] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 163.007] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.655] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.758] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:34 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.464] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.541] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.093] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.735] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:35 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.406] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.441] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: na.elf, 5432.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5435.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5437.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5439.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5441.1.00005616cb209000.00005616cb2b9000.rw-.sdmp, na.elf, 5443.1.00005616cb209000.00005616cb2b9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.698] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.029] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.521] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 162.862] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 170.080] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 159.877] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.300] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.340] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.467] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.207] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.086] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.315] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 155.219] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.330] (--) vmware(0): w.red: 8
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.929] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.551] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:26 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 161.355] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:25 galassia /usr/lib/gdm3/gdm-x-session[5690]: message repeated 4 times: [ (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)]
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.352] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.554] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 169.445] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.578] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.933] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.917] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: syslog.26.dr	Binary or memory string: Oct 6 15:30:27 galassia /usr/lib/gdm3/gdm-x-session[5690]: (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.500] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.790] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.149.dr	Binary or memory string: [ 160.599] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5602)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5441, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5432.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.00007f3d58001000.00007f3d58011000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5441, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	71%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Agent.J.14

Name	IP	Active	Malicious	Antivirus Detection	Reputation
byte-mirai.kro.kr	154.216.20.119	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.rsyslog.com	syslog.26.dr	false	unknown
http://wiki.x.org	syslog.26.dr, Xorg.0.log.149.dr	false	unknown
http://www.ubuntu.com/support)	syslog.26.dr, Xorg.0.log.149.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
50.75.247.215	unknown	United States	12271	TWC-12271-NYCUS	false
121.68.226.231	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
52.154.85.247	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
36.122.243.133	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
79.126.80.105	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
99.189.112.247	unknown	United States	7018	ATT-INTERNET4US	false
116.215.125.144	unknown	China	24506	YAHOO-TP2YAHOOTAIWANTW	false
218.177.66.138	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
38.206.46.29	unknown	United States	9009	M247GB	false
180.91.109.254	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
164.148.222.176	unknown	South Africa	37130	SITA-ASZA	false
90.228.230.167	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
206.60.251.11	unknown	United States	8014	BATELNETBS	false
19.65.140.119	unknown	United States	3	MIT-GATEWAYSUS	false
152.111.42.244	unknown	South Africa	10474	OPTINETZA	false
79.171.51.159	unknown	Albania	50973	VODAFONE-AL-ASNAL	false
138.15.168.75	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
116.155.151.233	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
153.53.228.63	unknown	United States	14962	NCR-252US	false
23.3.160.8	unknown	United States	16625	AKAMAI-ASUS	false
171.188.138.64	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
82.94.116.248	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
5.204.247.47	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	false
50.49.200.51	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
209.245.20.132	unknown	United States	3356	LEVEL3US	false
27.139.147.166	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
131.148.134.161	unknown	United States	33363	BHN-33363US	false
102.88.73.139	unknown	Nigeria	37075	ZAINUGASUG	false
57.84.101.28	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
68.9.113.117	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
148.25.28.30	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
78.194.144.170	unknown	France	12322	PROXADFR	false
216.236.30.139	unknown	United States	7029	WINDSTREAMUS	false
171.174.114.202	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
98.39.11.59	unknown	United States	7922	COMCAST-7922US	false
116.95.104.31	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
207.109.44.206	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
151.79.218.36	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
65.176.213.59	unknown	United States	1239	SPRINTLINKUS	false
64.189.162.167	unknown	United States	11232	MIDCO-NETUS	false
154.137.125.106	unknown	Egypt	37069	MOBINILEG	false
175.28.198.104	unknown	Japan	7679	QTNETQTnetIncJP	false
120.109.89.2	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
178.157.234.76	unknown	Denmark	43557	ASEMNETDK	false
151.108.112.193	unknown	United States	1218	NCUBE-BELMONT-ASUS	false
96.144.25.49	unknown	United States	7922	COMCAST-7922US	false
139.132.244.151	unknown	Australia	7645	DEAKIN-AS-APDeakinUniversityAU	false
167.202.129.69	unknown	United States	2897	GEORGIA-1US	false
185.222.2.214	unknown	Austria	206091	PLANET-DIGITALAT	false
155.195.109.39	unknown	United States	8698	NationwideBuildingSocietyGB	false
130.37.54.204	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
76.143.101.70	unknown	United States	7922	COMCAST-7922US	false
82.120.104.0	unknown	France	3215	FranceTelecom-OrangeFR	false
132.211.248.196	unknown	Canada	376	RISQ-ASCA	false
132.123.194.79	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
175.3.199.165	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
140.13.164.187	unknown	United States	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
66.163.125.143	unknown	United States	29877	STS-TELECOM-AS-1US	false
201.41.82.51	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
9.170.73.42	unknown	United States	3356	LEVEL3US	false
223.217.50.208	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
9.55.228.117	unknown	United States	3356	LEVEL3US	false
153.151.199.185	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
165.12.32.158	unknown	Australia	9509	DESE-AS-APDepartmentofEducationSkillsandEmploymentAU	false
1.182.56.125	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.240.170.216	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
17.10.55.43	unknown	United States	714	APPLE-ENGINEERINGUS	false
131.220.154.233	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
195.175.13.226	unknown	Turkey	9121	TTNETTR	false
169.246.111.61	unknown	United States	557	UMAINE-SYS-ASUS	false
41.68.96.102	unknown	Egypt	24835	RAYA-ASEG	false
121.17.68.36	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
166.199.83.244	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
195.215.21.110	unknown	Denmark	3292	TDCTDCASDK	false
109.93.37.93	unknown	Serbia	8400	TELEKOM-ASRS	false
200.62.175.26	unknown	Peru	12252	AmericaMovilPeruSACPE	false
73.152.2.129	unknown	United States	7922	COMCAST-7922US	false
177.204.170.46	unknown	Brazil	18881	TELEFONICABRASILSABR	false
189.177.62.126	unknown	Mexico	8151	UninetSAdeCVMX	false
118.240.23.172	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
46.129.121.107	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
64.127.73.31	unknown	United States	22343	VONAGE-BUSINESSUS	false
211.133.204.112	unknown	Japan	10010	TOKAITOKAICommunicationsCorporationJP	false
40.6.193.216	unknown	United States	4249	LILLY-ASUS	false
69.166.103.252	unknown	United States	26527	LIGHTWAVE-NETWORKSUS	false
205.206.132.176	unknown	Canada	852	ASN852CA	false
191.3.3.235	unknown	Brazil	7738	TelemarNorteLesteSABR	false
148.79.152.86	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
14.43.113.60	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
191.160.251.189	unknown	Brazil	26615	TIMSABR	false
170.238.180.244	unknown	Brazil	266331	GlobalNetInformaticaLtdaBR	false
106.236.197.222	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
88.104.99.42	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
152.144.240.237	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
202.142.190.207	unknown	Pakistan	135523	MULTINET-IE-AS-APMultinetBroadbandPK	false
140.6.213.54	unknown	United States	668	DNIC-AS-00668US	false
201.20.190.1	unknown	Brazil	11835	NOVAFIBRATELECOMSABR	false
178.129.232.160	unknown	Russian Federation	28812	JSCBIS-ASRU	false
171.56.84.32	unknown	India	9874	STARHUB-MOBILEStarHubLtdSG	false
208.70.216.98	unknown	United States	17054	AS17054US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
50.75.247.215	nk0pXoHYsW.elf	Get hash	malicious	Mirai	Browse
50.75.247.215	ZG9zarm7	Get hash	malicious	Mirai	Browse
79.171.51.159	ako1Zf5E6P.elf	Get hash	malicious	Mirai	Browse
138.15.168.75	5VOJ8ukAac	Get hash	malicious	Mirai	Browse
79.126.80.105	fWWj9IuPgZ.elf	Get hash	malicious	Mirai	Browse
79.126.80.105	Q1BPEcSFNH.elf	Get hash	malicious	Mirai	Browse
218.177.66.138	NuQd72CIeK.elf	Get hash	malicious	Mirai	Browse
38.206.46.29	u9afRawaNV	Get hash	malicious	Mirai	Browse
180.91.109.254	mo68mtK9Ap.elf	Get hash	malicious	Moobot	Browse
206.60.251.11	BFgg8MBpvo.elf	Get hash	malicious	Mirai	Browse
206.60.251.11	k374aQPv6s	Get hash	malicious	Mirai	Browse
19.65.140.119	sAchsbrVaX.elf	Get hash	malicious	Mirai	Browse
19.65.140.119	vf2MKvkv6c.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-mirai.kro.kr	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CSTNET-AS-APComputerNetworkInformationCenterCN	na.elf	Get hash	malicious	Mirai, Okiru	Browse	49.223.45.114
	arm-20241006-0950.elf	Get hash	malicious	Mirai	Browse	159.227.160.164
	6BTZGMvUv1.elf	Get hash	malicious	Unknown	Browse	159.226.152.221
	yakov.m68k.elf	Get hash	malicious	Mirai	Browse	180.90.255.245
	yakov.mpsl.elf	Get hash	malicious	Mirai	Browse	124.17.192.46
	novo.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	49.210.178.12
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	180.90.167.242
	S1WVSiZOLX.elf	Get hash	malicious	Mirai, Moobot	Browse	115.175.70.127
	mirai.x86.elf	Get hash	malicious	Mirai	Browse	124.21.209.178
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	210.72.61.253
CNIX-APChinaNetworksInter-ExchangeCN	na.elf	Get hash	malicious	Mirai, Okiru	Browse	59.108.216.166
	na.elf	Get hash	malicious	Mirai	Browse	117.118.236.172
	na.elf	Get hash	malicious	Mirai	Browse	101.39.5.9
	na.elf	Get hash	malicious	Mirai	Browse	116.157.236.150
	na.elf	Get hash	malicious	Mirai	Browse	211.153.84.2
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	101.107.252.131
	arm7-20241006-0950.elf	Get hash	malicious	Unknown	Browse	1.202.84.243
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	58.119.207.173
	novo.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	219.142.7.83
	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	118.226.70.7
TWC-12271-NYCUS	na.elf	Get hash	malicious	Mirai, Okiru	Browse	108.176.28.17
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	68.173.238.97
	http://www.hbparts.net	Get hash	malicious	Unknown	Browse	24.199.112.71
	http://www.hbparts.net	Get hash	malicious	Unknown	Browse	24.199.112.71
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	67.243.134.246
	i586.elf	Get hash	malicious	Unknown	Browse	172.254.73.168
	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	72.231.70.79
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	72.227.159.168
	sora.spc.elf	Get hash	malicious	Mirai	Browse	68.174.67.204
	SecuriteInfo.com.Linux.Siggen.9999.6015.2041.elf	Get hash	malicious	Mirai	Browse	142.255.19.192
MICROSOFT-CORP-MSN-AS-BLOCKUS	na.elf	Get hash	malicious	Mirai, Okiru	Browse	52.165.65.43
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	52.189.20.92
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	20.67.73.45
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	52.122.36.6
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	51.142.97.176
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	20.17.17.212
	na.elf	Get hash	malicious	Mirai	Browse	20.172.189.89
	na.elf	Get hash	malicious	Mirai	Browse	21.24.45.232
	na.elf	Get hash	malicious	Mirai	Browse	21.10.182.138
	na.elf	Get hash	malicious	Mirai	Browse	22.94.123.231

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/5636/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5639/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5641/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/5643/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5645/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5647/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5650/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5727/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5755/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5758/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5762/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5764/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5766/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5768/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5771/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/5949/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6109/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6127/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6357/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/avahi-daemon/pid

Download File

Process:	/usr/sbin/avahi-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:6Uvn:6Uv
MD5:	0648FC78B9C2BBECF4FCCF8AC0B9A1E7
SHA1:	7C13B91C2F12545B1E4C975BF5B5DA720A1E07F3
SHA-256:	40E49A06C414555837229D72DC50EA41E822D77BBC967B668A211E5DF0E0D97C
SHA-512:	60D5F8FE8D238A89257F858DAA9B45565F82FD456E802C9E4BF42E579830532790A5F9B2992CCA7CE6ACE19B8AD5A7A57E52F314E3D64AD0680962945CDFA564
Malicious:	false
Preview:	6121.

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Fcj:m
MD5:	4672B70266DE369E4B482C3D63D6AF0D
SHA1:	47C521A0128CE04F31661D1806832145419CC7A8
SHA-256:	6B0D86E7F74932520E64CCFE43660AB10722142BFB2085CF8A4AC916A8462D69
SHA-512:	903557A6F322DD70308B6AE6CF8E0595935BAE19374F7855CF98A2339ED2FC92B4ADC726851C342DAA9DBD8E40A0E01139555CC60BE3E4210687F1B0DA1F9AF7
Malicious:	false
Preview:	5596.

/run/systemd/inhibit/.#1XdzvZa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095924324939378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9ifDWM1IppTMXSHK72X8/Sf9n:SbFuFyL8OAApfDW0ApLHK7wR9n
MD5:	D49964B0A3C9F8D859CAF3F0896E7C6A
SHA1:	936D4110CAC6E504325B91A8821157F170AC0237
SHA-256:	E3164EC1CBEED116902E64E3F9883F039DE2518568361AC1540DBDA94DC70CD6
SHA-512:	7763CD279105714CF7A913A0AEF8B0BC6FE7353F67614B8263F6E9E6BEDEAB81DC878D8750E035990080EC3E611B8E66DDE0F8A4ED268F8515181E7D71CBEE93
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=0.PID=5959.WHO=UPower.WHY=Pause device polling.FIFO=/run/systemd/inhibit/1.ref.

/run/systemd/inhibit/.#2qzKwab

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.195387072061649
Encrypted:	false
SSDEEP:	6:SbFuFyL8NEL1QXccIRI/cIlGjdC+W+0qKLXv0Rsz:qgFqXQXTI1IltqKjcRsz
MD5:	5EBE912A0E64417E580C58340F484BE5
SHA1:	6EA6147912F8ED7B393B3CABA50AF97F45AC671A
SHA-256:	F642539857563326786F7C59B9FB3BB9509EC5A4D5ECC2E85C0C711C67820087
SHA-512:	319F9B011F326DABA6FDA685193E37883979C17658E4398405016A964DD4C1B002B4BBEA6D26572EBED13CCCA7BEA0A218921E54CF3A4C0B3FA687A21C9B9C18
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=handle-power-key:handle-suspend-key:handle-hibernate-key.MODE=block.UID=127.PID=6161.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/2.ref.

/run/systemd/inhibit/.#3EN7mab

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.148187060462055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++X+j4iXoqKZLXviX8/SfWADv:SbFuFyL8OAAx+W+0qKLXv0RT
MD5:	9172F1C06B0A6B73162911003A193683
SHA1:	A1060359A9ACDB5C0F29E4C23CE443F8FC21AC57
SHA-256:	787B23103E0F71E74E9C8EF9A4B4DA287A4A2CC2892A4590F272DDE4F098B3E9
SHA-512:	9D552F1A099490E1EE2C1A6079A631F2D0DB32DB64961037B873DD8133A9ADA243B2342CFEFFF5DC031043792CC10A73D8F3EC589E910F6EC5310A1DA34D741F
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6161.WHO=gdm.WHY=GNOME handling keypresses.FIFO=/run/systemd/inhibit/3.ref.

/run/systemd/inhibit/.#4vlhGUb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.138883971711133
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs/eWJAAVu9c++nqI3iXulpv5RX8/SflY:SbFuFyL8OAAx+EFlpLRS
MD5:	A4190A3AC64A50FC86AE5115194C1CE7
SHA1:	5D0A9A68D43E7F423ECEF5734E6F050D4B18C238
SHA-256:	F03C244926E1A1FE557264427CE64C60D87F4E04BAD82B34D10B94A5CC0C349C
SHA-512:	CB7B13A587673A70F4F73F80679A93170E5EC9E87E613B60F2CA6B459DB78789560F38F59564AC3470FE905EFB8B22E9B87CA3B4200DF20C6D67C421043A2F61
Malicious:	false
Preview:	# This is private data. Do not parse..WHAT=sleep.MODE=delay.UID=127.PID=6176.WHO=gdm.WHY=GNOME needs to lock the screen.FIFO=/run/systemd/inhibit/4.ref.

/run/systemd/seats/.#seat07tYIw9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Gyn9jc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0IOlOu9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/seats/.#seat0TYGbqa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0XfsMoa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0mFJVk8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.960504169374753
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G88mNvt2KwshcXSv:SbFuFyLwH47Pg20ggW8Gc12rNXc
MD5:	0EDD8049A9E5176912C3C2CBE234DFDB
SHA1:	616927BAAF2CF712B1D1F7F3A8F0507CAA5EAC6C
SHA-256:	434739B0976400CCB6A6302EF461A199F0A5D77E2AF9920D50DE2D799F07E9D6
SHA-512:	171A582F760BF8F9E23DB8ED7EDCE5D88B3B6532E1A46ECB3200291F480682EC5ABAA3B4464E639410A9098CD9AA464EDF6D92CEA0D625C40AACF65FED79E3D4
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c1.ACTIVE_UID=127.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0wZMV37

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.974985332353238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+8G/aQvt2ze5XSv:SbFuFyLwH47Pg20ggW8Od12z0Xc
MD5:	638FD4D562360E2AE0FE6842F6853400
SHA1:	CBDEA5AA977FAB4C2DA4C6947CFECFD4B641A644
SHA-256:	565DDE081A5672324151D2EFF5E529ACF29FA96FFCAB42C24FE8A246E929364A
SHA-512:	07CD1D41240B27E815AF85BBF6195001A672FEFA70DBF3B89AD5A128E850BA740DEEE3EA8A77A5ABFBC5ECD86F3EAFD40B5512348C1161265C90EE858DD51F86
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.ACTIVE=c2.ACTIVE_UID=127.SESSIONS=c2.UIDS=127.

/run/systemd/sessions/.#c13PIu78

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.421012439408234
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKiCgkfj:qgFqPuFN6IG0n99x2xayWKiCgaj
MD5:	811EE17CA6C8B1CDBD7EC691758EEAD3
SHA1:	D911349C9168A06A1C086A76E6E7BBD17CBB91AE
SHA-256:	23ED0E260F541E9EBFB1B3D5CA0F16AC62D7B223ACB1848C20D1542F728C085F
SHA-512:	77166A2AF7F0F69C0B6D92B2B299726BCB1FAEA6DD4D57A2DCF0AC75D288F5C51E5891AB257C5EE52248904EC53BF1AC54B913F139CFB393340C09F1E325A78F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c13SWrZb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420418580886915
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBKiCgkfj:qgFqPumW8IG0n99x2xayWKiCgaj
MD5:	50B840615AD53154902AA44866CE0C71
SHA1:	B62EB211FED147DA1E201211A94DC0F56D188B52
SHA-256:	86670CF0AAACC04A6A62EE395F8DAB700F93E7E29C4ADF3504E233A8F9646882
SHA-512:	4556FCEFEF86D1031FD94D796149717822465E55BFA1C87AE47A919BFDF966078D4AC84468304DC90AB3224C391D9D2BBA6601A9007337550E958CE36B7E0528
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c15BBu3a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.434770071538117
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKiCgkf73:qgFqPuFN6IG0n99x2xayWKiCga73
MD5:	8232C822A080C37EE008608084DB9A07
SHA1:	50D8AF8527D42A4DE5BB92FEC51367670F5E6AFB
SHA-256:	F99C4347EEB3790CB0454CD16FA2A85DAAF837C26E8D0F0E0B1BB337400F17D0
SHA-512:	09C6B66D9C83EE691D1CA9E819E9F8AB65044112022B2ADD8905260501261FE6D9DF2264D744AC166603419B0BF4987165889B9FE01CBD7812D4AC9898A212A5
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.CONTROLLER=:1.13.

/run/systemd/sessions/.#c1ROBcx8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.377604066164741
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPddL32UKBhcIixfx2xNIByy6GBKiCgkfj:qgFqPuFdDJIi9x2xayWKiCgaj
MD5:	0CEA08D7248CE05A0CFD7060E9989B16
SHA1:	C2CE8A207A64613D8535964AD86E59F7EC460919
SHA-256:	84D00396EBBDBCF97BFEAE28DB1BEB55064FC03F824F53BC6F31C4D60931E153
SHA-512:	FA73EF2BCD4391FFF8D2BE5EAAB1024E03CF2E1A0756C42276A606DC8F6167AD770B194A2D87D7F0BD2F353845D063162F3CACF9072EF0CC3932A18D5D6ED8A3
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=closing.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c1bIvnEa

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.420418580886915
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedL6vUKBhcIGjwn9xfx2xNIByy6GBKiCgkfj:qgFqPumW8IG0n99x2xayWKiCgaj
MD5:	50B840615AD53154902AA44866CE0C71
SHA1:	B62EB211FED147DA1E201211A94DC0F56D188B52
SHA-256:	86670CF0AAACC04A6A62EE395F8DAB700F93E7E29C4ADF3504E233A8F9646882
SHA-512:	4556FCEFEF86D1031FD94D796149717822465E55BFA1C87AE47A919BFDF966078D4AC84468304DC90AB3224C391D9D2BBA6601A9007337550E958CE36B7E0528
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=online.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c1gvE507

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.4799742502223445
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcedVuRmUKBhcIS3xffLHxfx2xNIByy6GBKiCgkfj:qgFqPumVuRZI4BD9x2xayWKiCgaj
MD5:	DCBA9D0B7884325D4234C28C2195CCB1
SHA1:	81AB1B3243FF40422595D26F6C7C640645615400
SHA-256:	E93B636B91A1411C8075D88A0B943E16AD083DDDAC2B39693ACA801126ADF931
SHA-512:	037F3322D5294EBB845A581AE7C7A400F447884B1E976A38CC1B3F07E888F22026A0EEC13DA280097C0936F4F2CAAA07505A63171008F3FA6BBA7B55095F9834
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=0.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7747.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c1pna857

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.421012439408234
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNdUKBhcIGjwn9xfx2xNIByy6GBKiCgkfj:qgFqPuFN6IG0n99x2xayWKiCgaj
MD5:	811EE17CA6C8B1CDBD7EC691758EEAD3
SHA1:	D911349C9168A06A1C086A76E6E7BBD17CBB91AE
SHA-256:	23ED0E260F541E9EBFB1B3D5CA0F16AC62D7B223ACB1848C20D1542F728C085F
SHA-512:	77166A2AF7F0F69C0B6D92B2B299726BCB1FAEA6DD4D57A2DCF0AC75D288F5C51E5891AB257C5EE52248904EC53BF1AC54B913F139CFB393340C09F1E325A78F
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=wayland.CLASS=greeter.SCOPE=session-c1.scope.FIFO=/run/systemd/sessions/c1.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5620.REALTIME=1728246602655171.MONOTONIC=137240920.

/run/systemd/sessions/.#c22l2cLb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.454697288187456
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvA9t8c:qgFqPuFNuCH0nI9x2xayWKugNc
MD5:	2C2D105135C0A1553DAFE8C1C3D06935
SHA1:	A208D2E212D9FB7C61C7B9364FE0812B357D061C
SHA-256:	B953DDC409EBD555E7BFB679878DE8330EAE9EE2A09995D85F297F75F900D8DA
SHA-512:	347749D5D7B7AAEFF08370A55924E14D78380A3D93604DFC2CB2057D50D21299F2E3751625EB30B62EFA14596FA9BF5C5F686ED2CC8B74686B3762EA8B112C98
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.CONTROLLER=:1.17.DEVICES=13:66 13:65 13:64 13:67 .

/run/systemd/sessions/.#c24eZGr9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.435721292984647
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvA9tl:qgFqPuFNuCH0nI9x2xayWKugS
MD5:	15D2097C3D0480E4221980376CBF9490
SHA1:	722FD73EAFC9806C56F941B0E724A56A72D8FFE3
SHA-256:	284C3DC33820CBFAC63FD1D924BB890886BBDA70FF953A8313A7BA5D1B7736E4
SHA-512:	F7FEFC89678109FEF52ADEFF8F14C32901DB1932682CBD671E6090D7FEE5217985B3C7031DAEB6FACAC4310A0340FACBF8B547C8ECBAD70AB0CEC0B78496B6A3
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.CONTROLLER=:1.17.DEVICES=13:64 .

/run/systemd/sessions/.#c26MZpqb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.420353097705955
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvAH:qgFqPuFNuCH0nI9x2xayWKugw
MD5:	BCB9F4AEFDB2D8F590DAC92179D606D3
SHA1:	72BF2C160BDD541C2072EF7A75B77B80D25A06CE
SHA-256:	4C372D610CC1013BA58368350FB6CF58450E7B17B3D607101A42C732D17F2D74
SHA-512:	0F6D32168CDA8D1F535447CA3BE9FEFF65F561E61EB53987CC32874705271F7C354031F74690919CEAD44D7888E27AB6EBF52ECB6F8C878FB7DD05683354C538
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.

/run/systemd/sessions/.#c2K1Bdh9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.420353097705955
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvAH:qgFqPuFNuCH0nI9x2xayWKugw
MD5:	BCB9F4AEFDB2D8F590DAC92179D606D3
SHA1:	72BF2C160BDD541C2072EF7A75B77B80D25A06CE
SHA-256:	4C372D610CC1013BA58368350FB6CF58450E7B17B3D607101A42C732D17F2D74
SHA-512:	0F6D32168CDA8D1F535447CA3BE9FEFF65F561E61EB53987CC32874705271F7C354031F74690919CEAD44D7888E27AB6EBF52ECB6F8C878FB7DD05683354C538
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.

/run/systemd/sessions/.#c2KanZda

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.453391786055123
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvA9tmc:qgFqPuFNuCH0nI9x2xayWKugjc
MD5:	3A17E144BA71D7AB604F843B71ADDB6B
SHA1:	530F0B97A8651D19C6189EC2550B2E415C864007
SHA-256:	A36F3C3B8C84DEBA8F8DCE484A9B12CD28E7FBDF05E4D50AF044CBA9766F8BB0
SHA-512:	7EF336D3AB9717302EECF4465630ADE235226888AE98D1A911A87A5ABFE0A57971A2471EFC0403A00AEA9700C58170F7169B550A5BF0F8333693E963F9D173DB
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.CONTROLLER=:1.17.DEVICES=13:65 13:64 13:67 .

/run/systemd/sessions/.#c2Tudltb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.428991129552348
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvA9t7:qgFqPuFNuCH0nI9x2xayWKuga
MD5:	8F799E76EE7594533E7EF452AEF3BB2E
SHA1:	F2C75AB44E14A1E3746525E946E7C9DB39730DF4
SHA-256:	6B04F78CBBF4912AE5439506EAF57DBD0547156C8D5E6BC97C5193A8BB2B6FA2
SHA-512:	5193917E5D02123C64B62377792C4A850C11F2CF6FDF2849D1F4E9D2ED69AFDC6AA5D300698726C49CC476AFEACE725157E794EF6401C53A28C09382DA4D00C4
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.CONTROLLER=:1.17.

/run/systemd/sessions/.#c2fwmwAb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.446574282608854
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdNH/hc/KHjwnsDxfx2xNIByy6GBKugvA9tAn:qgFqPuFNuCH0nI9x2xayWKug3
MD5:	A14C39DC2396EB450C1641C6298EBBCC
SHA1:	57B5FD97C46BE32F5337ED5D92F4671686B0DFE1
SHA-256:	FD7D53A24EBA322D999B90E7B61B5FEB1627889685E670A08B8661F5CF83D972
SHA-512:	D0085B611E43EA9842A3091A9F543FB1BAC560941C7796829AC6180C5EA44986459EAEF8605DEFEF800F7DFB26FBB9063D7EC9BF8664481EC25D8748D256E020
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=active.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.FIFO=/run/systemd/sessions/c2.ref.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.CONTROLLER=:1.17.DEVICES=13:64 13:65 .

/run/systemd/sessions/.#c2oBHUra

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.471569470147396
Encrypted:	false
SSDEEP:	6:SbFuFyLPCOcPdVuRQ/hc/Kf3xffC5hBxfx2xNIByy6GBKugvAH:qgFqPuFVuRpCvBKB9x2xayWKugw
MD5:	FBA360D40023204B74A6CE15E1856B36
SHA1:	58D39CD10787B00ACB66F9F67A01980EEDE9EBB9
SHA-256:	F65AC5C2BED6A0BD78C4BF049AA93F45F7A45C9DA4AE59B83EB05C3DD99A3D16
SHA-512:	A75CC591C3C847ED3DE8F383FB1942318C79F3C14D62BD06FB5BE604B19150EF7BA1F936E4CF3F6B35DEF77B5F8D7579921224AB45DECD1518DB53B85CC5FCAA
Malicious:	false
Preview:	# This is private data. Do not parse..UID=127.USER=gdm.ACTIVE=1.IS_DISPLAY=1.STATE=opening.REMOTE=0.TYPE=x11.CLASS=greeter.SCOPE=session-c2.scope.SCOPE_JOB=/org/freedesktop/systemd1/job/7810.SEAT=seat0.TTY=tty1.TTY_VALIDITY=from-pam.SERVICE=gdm-launch-environment.VTNR=1.LEADER=5678.REALTIME=1728246615924682.MONOTONIC=150510431.

/run/systemd/users/.#1270O1UIb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.114364217570755
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSfgbAu0TpQ2thQc2x9sS02/g2owB:qgFq30NzL/ixegbAu0thQHxbPYA
MD5:	39228E2BBC6B4A004AE111A8B21F9303
SHA1:	3334A79E15530AFA43AC26FBE3596D51A099305B
SHA-256:	33FE900D15402298C6AE20A74A0AA8181DC684D97669A7D51AA34A2737D9E7DB
SHA-512:	B2F7C26D63B0DC198F1029F134B620E932504E8F4131C8B56E2F8B90571CAD70FBAB7A54950C3BC2A0C4A67E8511E0DC0E4952820E7B351AAAD0DA1CA0EE84C8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=c1.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278nql99

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.122736605962239
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgbAu0TpQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegbAu0thQHtPYq9M
MD5:	60406EEBF4D44638DD64A080D22608BB
SHA1:	66D9714BC8A0541FA78EFB91B56C3E329F1D57DD
SHA-256:	490F5FF5FA964E297CF4900C2F924E2457899ED029618068E2427C489BC2F1D2
SHA-512:	612C28185CC7F455B5EA8720720F36F046D932CA32030EBC65B43DFBFFD4FE848210F45A9BCC5D5BE13F4DD23BC992E66BD62DF10C7BA27E81B7DAE4BBFF14FD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127A6Ya4b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.119335275881755
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgbAu0TpQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegbAu0thQHtPnmDq9x
MD5:	0BA2D6EC50C1045F404C85BC554DE6C9
SHA1:	ED3870DB5D755004EEA1CF68929BA067E16A2EF9
SHA-256:	D2B13F0AA9BFB9D3BD0C91F142192D721B8C3EA631D0C6B209AC02F61D3C4B47
SHA-512:	E6D08E497507DCD86786D6F0126606B11D7848E73B7428AEC479DE1A74D7537C0B92D345F8A4E11C5FE287E914BCC0BDB881B0BB790D3E98DCCB918477D8BE79
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127F3CQUb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.119335275881755
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgbAu0TpQ2thQc2pb02nmD2p9rwC:qgFq30dAL/ixegbAu0thQHtPnmDq9x
MD5:	0BA2D6EC50C1045F404C85BC554DE6C9
SHA1:	ED3870DB5D755004EEA1CF68929BA067E16A2EF9
SHA-256:	D2B13F0AA9BFB9D3BD0C91F142192D721B8C3EA631D0C6B209AC02F61D3C4B47
SHA-512:	E6D08E497507DCD86786D6F0126606B11D7848E73B7428AEC479DE1A74D7537C0B92D345F8A4E11C5FE287E914BCC0BDB881B0BB790D3E98DCCB918477D8BE79
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=.ACTIVE_SEATS=.ONLINE_SEATS=.

/run/systemd/users/.#127F98YF9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127KBW7ib

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.122736605962239
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSfgbAu0TpQ2thQc2pb02/g2p9rwB:qgFq30z1cL/ixegbAu0thQHtPYq9M
MD5:	60406EEBF4D44638DD64A080D22608BB
SHA1:	66D9714BC8A0541FA78EFB91B56C3E329F1D57DD
SHA-256:	490F5FF5FA964E297CF4900C2F924E2457899ED029618068E2427C489BC2F1D2
SHA-512:	612C28185CC7F455B5EA8720720F36F046D932CA32030EBC65B43DFBFFD4FE848210F45A9BCC5D5BE13F4DD23BC992E66BD62DF10C7BA27E81B7DAE4BBFF14FD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127U6Amma

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297311081734012
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffMQzSfgbAu0TpQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUQzegbAu0thQHtPYb
MD5:	F86DC4AAFCAB8133762DFBDA589A0849
SHA1:	20E04DFBE913982027A3B1FADC29CA3404EE74AC
SHA-256:	C9B85DBD133BE232276483D2B6E3BEFAE5C982628588BA51A0BB4E04264769A6
SHA-512:	F79029023635331461114E843B0434239D7441DA00A5B3AE47FA6570BF9AC1F29C6BEA49D4B3D045E04D208ED66F8F9F6FFB601D6C607A90F68F2CB8CAD19A65
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7685.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UQfBh8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.121934474661952
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiyaSaTgbAu0TpQ2z5c2zw02zb2owB:qgFq30z1cL/ixxTgbAu0z5HzwPzbA
MD5:	B07633CAE2FB6712BB9312922DCFA542
SHA1:	1013ADAF1E12391E5DC0E4221DC1D26F9207E4CC
SHA-256:	65D48D1B24D989D6A8850EA0BF258812CDCD99C7E6688B383FB77B7AC938C809
SHA-512:	BD07528227949DFA37D704DD5D6A27D52AAFC3A283293C0540309CFA88C00A10C3DE376C5C696155D303B6391E03A8C123DCA72D3A530146A4F47AD311D53B7A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ePhMY9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.100797620180896
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgL4q1c7iesnAiRJgbAu0TpQ2z5c2zw02zb2owB:qgFq30z1cL/iRJgbAu0z5HzwPzbA
MD5:	0F85285139C9EF5050BBF10488D0F585
SHA1:	FBA1AA24C7FF98197E62A405E173FE8B43D660B4
SHA-256:	82C3AF489897E666566882141C4560A3CF21D189FB73D62F85398DDDC540FE8F
SHA-512:	DF448E0E804C2DB52C43091F46D529BB24D5B81038E9D265645FC9D4BCE65F98DB7C2CAE1D4E2129FBF1FBDDA9698DBD78ACB1FAAD008F36974A8EECE602FAA9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=online.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nC8kOb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.105998219681871
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgNz7iesnAiyaSaTgbAu0TpQ2z5c2zw02zb2owB:qgFq30NzL/ixxTgbAu0z5HzwPzbA
MD5:	88C1E2B4F8B6311A2FC42DECE0AA1160
SHA1:	5A3AEAD74958FF80F23F93ACAD55110893C46F58
SHA-256:	61D5A76A6338EE47EA4B0509BA91B0EADBC2964182503582E90A1D4CACD3E1C7
SHA-512:	641E0025D76CE58C7E17B17AC68ED535B4C8A0F60175BDE34A0A372CA24C6126AD6E8DFCC9C36C1D2D9C1FF7EA58004FA24721E547BFE2CF478BAAB22C572229
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=active.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c2.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c2.SEATS=seat0.ACTIVE_SESSIONS=c2.ONLINE_SESSIONS=c2.ACTIVE_SEATS=seat0.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nzGKF9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.1324370187815775
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87iesnAiyaSfgbAu0TpQ2thQc2x9sS02nmD2owC:qgFq30dAL/ixegbAu0thQHxbPnmDd
MD5:	B1ECCF5CDA88AE4DA91D96471F41D263
SHA1:	7972F0EEC71A2BC319B7A5E616D09EF2F5F4C8ED
SHA-256:	9F0BFDCDE80B8C85D008AC6EE29ECC5B3614548BFF4405E99B9A7046D461FBAD
SHA-512:	29D41A1F99057B4D3C748AAC3DB7DA68E55168A051D764139D8E984CDC86939B910088B2A0484EB4B2745740AF9B3624083435BC4E45E7CD15AF08B879D0699F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.DISPLAY=c1.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=c1.ONLINE_SESSIONS=.ACTIVE_SEATS=seat0.ONLINE_SEATS=.

/run/systemd/users/.#127zwYQX8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.27553749765378
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffMG5JgbAu0TpQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUEJgbAu0thQHtPYqi
MD5:	472C332E1141E178BCC814BC05BA40BD
SHA1:	5A4A19E939C6C2557A238E797095493DFBE88273
SHA-256:	27DA6E9C60ECA0F62A79DA7465B7C35233312B3351FDB69B0FBEF9214D8CDCB2
SHA-512:	95A0A27CDC0685973D41412C11141E246B1B2751104C0B8E952D0F1CD723FF92411C904D03B129493DE9EF48C8E054BEE4C785B3B0084AFD0251C0E79E1C97A8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/7685.REALTIME=1728246602622312.MONOTONIC=137208061.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:6dvn:6tn
MD5:	EB7DAC6FA6A5C98F2E5F9DF90E2FAEE5
SHA1:	15A8B8071A79F8A0A844E0D6F351AB0151A7A273
SHA-256:	649661547A40EDA6CC8692F86FF93F2DFCDEA94A0C8F05EB8EF1F5A4B8C295DF
SHA-512:	5C32A2A740FEC3C1AC75705F50ACA3632C2B41767F630DEE2ED30019CDDE76352FA7B23FAAC3666DA932B1D4EBFA21C88F7038BD99901E983726D2DAE4C93607
Malicious:	false
Preview:	6128.

/run/user/127/ICEauthority

Download File

Process:	/usr/libexec/gnome-session-binary
File Type:	TTComp archive data, binary, 1K dictionary
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.988363779183002
Encrypted:	false
SSDEEP:	12:OxPK66uOveY+KBXQixP/+4SeveY+/+OmQmxPH+rl9NOveY+H+5AxPu3o3ulveY+C:JXQe1Sp5mQhWyetbFZlHV1
MD5:	279BEA7B9A0008561CAF5BDCBDF9E461
SHA1:	07B8940BF64AD1834B3EFE4BBC4DB978FBBBB1D7
SHA-256:	BF116C23E3E9D55B99D1F24DC95AA4519CE5B479A45D308B507D48A1C2E23B91
SHA-512:	667CC3C30F0DC9A425C4FB700CF950F534461A44B81DCE0D375A917AC59E2221F775F17EBFD09C4DFBFA7C045DCB7B543ED8637404CBB16193E71AA5534D251A
Malicious:	false
Preview:	..XSMP...!unix/galassia:/tmp/.ICE-unix/5711..MIT-MAGIC-COOKIE-1..?4q..`..c.+....XSMP...#local/galassia:@/tmp/.ICE-unix/5711..MIT-MAGIC-COOKIE-1..</...8D$g.B....+..ICE...!unix/galassia:/tmp/.ICE-unix/5632..MIT-MAGIC-COOKIE-1..]..SD.....?\{....ICE...#local/galassia:@/tmp/.ICE-unix/5632..MIT-MAGIC-COOKIE-1.....Vz..p8d^: .....XSMP...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....3.16G.\|.Q.......XSMP...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..uoT..;.......%....ICE...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...)....I...b....L..ICE...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1..j...w~q]$M....<...XSMP...#local/galassia:@/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...i...........LE..XSMP...!unix/galassia:/tmp/.ICE-unix/1442..MIT-MAGIC-COOKIE-1...e.....-..3$....ICE...#local/galassia:@/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1....<..;..6<L.......ICE...!unix/galassia:/tmp/.ICE-unix/1588..MIT-MAGIC-COOKIE-1..ad.U~.OxR.c.}..(..XSMP...#local/galass

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-power
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

/run/user/127/gdm/Xauthority

Download File

Process:	/usr/lib/gdm3/gdm-x-session
File Type:	X11 Xauthority data
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.0217563256604105
Encrypted:	false
SSDEEP:	3:rg/WFllasO93Lth6pz/0aOWFllasO93Lth6pz/0n:rg/WFl27mOWFl27j
MD5:	F370E6F3FD5F894A0DF46E8F8E4D2062
SHA1:	6AFDBFDFF665864143C0FF8E4D939DF878EA7B56
SHA-256:	E5B736B74068F360F7E3F2150403335C21D7AEB6747CC96245EC709BD86AC0D3
SHA-512:	159A264CAC913AA8971D0C6EE8A605435BE43B6D8DF0BF68A0BBA536E46D379D7D7CE598544B1D492749094C821B6CDD1FE2C2871BC363C48A35CC86E396A825
Malicious:	false
Preview:	....galassia....MIT-MAGIC-COOKIE-1..&2.J..9.....Y.^....galassia....MIT-MAGIC-COOKIE-1..&2.J..9.....Y.^

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Jccn:5
MD5:	ADF06DAA10FBD36CE65CF432BA0D37C8
SHA1:	C529D7E274C65C144D268EB10EBAD745344D6265
SHA-256:	0378674830151C06C4A9E704A22B2D18B5DBE383B0CFA4E30C9BF6814FD9F109
SHA-512:	154705E92B5A852481F5DAFFBEB5362C4F051C5B81FE20B943B83BCD470F957237469123FA166C1A17B111B566A011FBC14A7807E6469E6277E42D116A6D7FF5
Malicious:	false
Preview:	5997.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:tlSsXlXEWtl/TUo:tlv+ylg
MD5:	28704C15F217BE5970551EA37130001E
SHA1:	8A2674581C765CA0A70368F4A6ACFCD3D3E25437
SHA-256:	55817B523716E650791335D084360B9836EAA2E922B8806FF11FE3E04C53CC02
SHA-512:	1626CFF70DC7B4B0B61815398D2C46F7B5D069B0D4A7FF7F91980D575D1E1998508449A0FBFA8A079F52CE2F1729F383657A91E06A2C8B02FA91AFB3628C0C6E
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................9..g.B......................................

/tmp/qemu-open.L4ykq8 (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/qemu-open.WhL1cB (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Preview:	/tmp/na.elf.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/AccountsService/users/gdm.55V5U2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.HX55U2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.162871962347481
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWW9BOiWdDZt8:q5sU3LWfLUDmQymqSFbfomSFOiaDZrf+
MD5:	7BD8BC463FA03F300AD2A92F81B4F5D7
SHA1:	034B8BEBF1E82A29EE201AB5DDDF2CCDBC82B26F
SHA-256:	A62881E655C22099CD4D28A635984A0D979AE574BAF05D1F21E48782DB8A7B92
SHA-512:	6ACAFC04CBEFA5CBBD8F1FB93FADE87151CDF20A9FDBABFABB426DF27B93BC75ABAC11F6C606B18F14EA999927E1B72DB8F78EAD6537E52B4628E85C69B25766
Malicious:	false
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-xoJCxNYk,guid=57d0ee6b3efa6838fba5955d6702f386.IBUS_DAEMON_PID=5941.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/Xorg.0.log

Download File

Process:	/usr/lib/xorg/Xorg
File Type:	JSON data
Category:	dropped
Size (bytes):	41347
Entropy (8bit):	5.278461313166581
Encrypted:	false
SSDEEP:	384:npOM8MYjTDUMybucIModefdzdPdhdDdOdTdQdZdhdndZdsdfdMd6d1dqd4dXdVJF:pO/RnAMqucvla/9b2BqlWoiR+iK
MD5:	54F3E0B7E38BB3C815E4CE07B3E2335C
SHA1:	57F578ADD2905DB0DE04ABABEEAFD403DAD6EB5D
SHA-256:	FCDA342FDD575FE8D1E2B8609F7825F5562800F4C2A0C3FB77ADB9B5018FDBC4
SHA-512:	E6DA2E2A258668468990F0B39E3135D6174D3FBAC2EF1ADBBC3826E4B217305D24AD385ED4685B57467ACBB815D7A6F8CCAEBA653EAB8B925187E76ED1A0932D
Malicious:	false
Preview:	[ 151.765] (--) Log file renamed from "/var/log/Xorg.pid-5690.log" to "/var/log/Xorg.0.log".[ 151.784] .X.Org X Server 1.20.11.X Protocol Version 11, Revision 0.[ 151.801] Build Operating System: linux Ubuntu.[ 151.819] Current Operating System: Linux galassia 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64.[ 151.832] Kernel command line: Patched by Joe: BOOT_IMAGE=/vmlinuz-5.4.0-72-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro maybe-ubiquity.[ 151.884] Build Date: 06 July 2021 10:17:51AM.[ 151.915] xorg-server 2:1.20.11-1ubuntu1~20.04.2 (For technical support please see http://www.ubuntu.com/support) .[ 151.926] Current version of pixman: 0.38.4.[ 151.936] .Before reporting problems, check http://wiki.x.org..to make sure that you have the latest version..[ 151.944] Markers: (--) probed, (**) from config file, (==) default setting,..(++) from command line, (!!) notice, (II) informational,..(WW) warning, (EE) error, (NI) not implemented, (??)

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2435
Entropy (8bit):	4.970409792868519
Encrypted:	false
SSDEEP:	24:rY/xB5tFdfZ4DZeCBeNMN4XAvQA2+Vu6BKrCQCve2vkFdbfRMRqrdcXjuoNuXrbe:rexBHWvVfVu6QrCdeQi60XrboyrCn
MD5:	E3EA77BB8BCFEBBA2ADB9FD3F128459D
SHA1:	55E72BD4706F1C7A314F52C72A3C87A6FBDC51BD
SHA-256:	38DD431777A2B0F477251A2B8BFFB3D70EB3D3298AA0B41459CCE861F62C0580
SHA-512:	6DE7D4B17F54747F22DF614CC45D10137EA75C5EA4DE7038568CBEC19DD278BF8335BBC26E3EB445A6A77CE4A134118F5778BFF0C5C64776466C44852151564F
Malicious:	false
Preview:	Oct 6 15:29:37 galassia systemd-logind[800]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Oct 6 15:29:37 galassia systemd-logind[800]: Session c2 logged out. Waiting for processes to exit..Oct 6 15:29:40 galassia systemd-logind[5501]: Failed to add user by file name 127, ignoring: Invalid argument.Oct 6 15:29:40 galassia systemd-logind[5501]: Failed to add user by file name 1000, ignoring: Invalid argument.Oct 6 15:29:40 galassia systemd-logind[5501]: User enumeration failed: Invalid argument.Oct 6 15:29:40 galassia systemd-logind[5501]: User of session c2 not known..Oct 6 15:29:40 galassia systemd-logind[5501]: User of session 2 not known..Oct 6 15:29:40 galassia systemd-logind[5501]: Session enumeration failed: No such file or directory.Oct 6 15:29:40 galassia systemd-logind[5501]: Watching system buttons on /dev/input/event0 (Power Button).Oct 6 15:29:40 galassia systemd-logind[5501]: Watching system buttons on /dev/input/event1 (AT Transl

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	42576
Entropy (8bit):	4.70788860813
Encrypted:	false
SSDEEP:	384:B1GU605vKDg9ESDydmm4g5TgdTgLTeTQeZT04NV7JOPfWvaN3LJKz2j:PGU605vuguSDydmpgNg5gf8Lt9h8
MD5:	1C90197158C914CD48A7897E4C687E45
SHA1:	65B45E5FA75E96846F1BADC7EAF627F2EF44ADE2
SHA-256:	4DD149A20E8FD824341C7BBC86E802BB6F27A4B6E70ED2E9DC4B996274972709
SHA-512:	68E0C8CAE0022FA3A8B12775CAE91F70BC6E778BE834541CD4D16E64424FEF4A8D62F7CB6FD06DC0894B259E6B4737B64AADF3BBCC73C5E20F9ECD269B6D28BE
Malicious:	false
Preview:	Oct 6 15:29:38 galassia kernel: [ 112.118250] MD5 calculation failed.Oct 6 15:29:38 galassia kernel: [ 112.331750] blocking signal 9: 5435 -> 936.Oct 6 15:29:38 galassia kernel: [ 112.510997] blocking signal 9: 5435 -> 1400.Oct 6 15:29:38 galassia kernel: [ 112.617196] blocking signal 9: 5441 -> 660.Oct 6 15:29:38 galassia kernel: [ 112.785428] blocking signal 9: 5441 -> 726.Oct 6 15:29:38 galassia kernel: [ 112.908479] blocking signal 9: 5441 -> 778.Oct 6 15:29:38 galassia kernel: [ 113.004517] blocking signal 9: 5435 -> 3132.Oct 6 15:29:38 galassia kernel: [ 113.076187] blocking signal 9: 5441 -> 936.Oct 6 15:29:38 galassia kernel: [ 113.194330] blocking signal 9: 5441 -> 1400.Oct 6 15:29:38 galassia kernel: [ 113.381444] blocking signal 9: 5441 -> 3132.Oct 6 15:29:38 galassia kernel: [ 113.444563] New task spawned: old: (tgid 5483, tid 5483), new (tgid: 5483, tid: 5493).Oct 6 15:29:38 galassia kernel: [ 113.446042] New task spawned: old: (tgid 5483, tid 5483)

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	152914
Entropy (8bit):	5.197650631626745
Encrypted:	false
SSDEEP:	768:irevoGU605vU2eAElq4eaKuIs2O/+gNg5gfrHQ5E0zZdYdCoM8:oGU605vPsI8Hw5E0zHQ
MD5:	3B38BF05C3BC4E5216DF460E2F71B338
SHA1:	9634CCCCA591A39275C41F3BD42919ED3AC1BDB3
SHA-256:	AEB8A0D4B5D03C9B55EEF8E80B9EAD35A5AB8B1EA9E98D871A9560748BA21261
SHA-512:	1A80E66DAB3EA7F0ECD66D91E79D914FB0C96290389746998FCCFFEBEEA09C0FD27F3D58FAEA0F09DB07B4B57D58DFC48F3260C0D2561F2A392711CCDDAD4A3E
Malicious:	false
Preview:	Oct 6 15:29:37 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Oct 6 15:29:37 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Oct 6 15:29:37 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Oct 6 15:29:37 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Oct 6 15:29:37 galassia systemd[1]: Stopped System Logging Service..Oct 6 15:29:37 galassia systemd[1]: Starting System Logging Service....Oct 6 15:29:37 galassia systemd[1]: session-c2.scope: Succeeded..Oct 6 15:29:37 galassia systemd[2935]: pulseaudio.service: Scheduled restart job, restart counter is at 1..Oct 6 15:29:37 galassia systemd[2935]: Stopped Sound Service..Oct 6 15:29:37 galassia systemd[2935]: Starting Sound Service....Oct 6 15:29:37 galassia systemd[1410]: pulseaudio.service: Succeeded..Oct 6 15:29:37 galassia systemd[1410]: dbus.service: Main process exited, code=killed, s

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:tlSsXlXEWtl/TUo:tlv+ylg
MD5:	28704C15F217BE5970551EA37130001E
SHA1:	8A2674581C765CA0A70368F4A6ACFCD3D3E25437
SHA-256:	55817B523716E650791335D084360B9836EAA2E922B8806FF11FE3E04C53CC02
SHA-512:	1626CFF70DC7B4B0B61815398D2C46F7B5D069B0D4A7FF7F91980D575D1E1998508449A0FBFA8A079F52CE2F1729F383657A91E06A2C8B02FA91AFB3628C0C6E
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................9..g.B......................................

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.247366246405126
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	64'304 bytes
MD5:	ee5ef9ca3a25d54b970c21a46569f1cb
SHA1:	370c7639e7b39e92ffbe37a0ac0d74d5dfdd5cf0
SHA256:	85516b9359150eaaa42f40bdc50b4fc8bb1f88ac6a834587a00c7399e7241152
SHA512:	126a58e1aafaf2f4172f11beb0de3b96ab9f7ff22596e21f7b8cdc8250c979100ac077471d6ef0f6157a8405fad8e9528d87768050ec2c67fa34e6af79fbfa96
SSDEEP:	1536:n7a01i8phE/YH/54WWl0jqh+cctqKPajE/X:Nphl4WzjcUqEOeX
TLSH:	52533B42731C0947D1A31EB0393F17E093BFE99111F4FA89691FAB469232E725586FC9
File Content Preview:	.ELF...........................4...P.....4. ...(..........................................................&t........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?..........t..../...@..\?......$.+../...A..$8...}).....$N..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	63824
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xde2c	0x0	0x6	AX	4
.fini	PROGBITS	0x1000dee4	0xdee4	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000df08	0xdf08	0x1600	0x0	0x2	A	8
.ctors	PROGBITS	0x1001f50c	0xf50c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001f514	0xf514	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1001f520	0xf520	0x3a8	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001f8c8	0xf8c8	0x3c	0x0	0x3	WA	4
.sbss	NOBITS	0x1001f904	0xf904	0x70	0x0	0x3	WA	4
.bss	NOBITS	0x1001f974	0xf904	0x220c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf904	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xf508	0xf508	6.2987	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xf50c	0x1001f50c	0x1001f50c	0x3f8	0x2674	2.6820	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time (UTC):	20:29:33
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	20:29:34
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	20:29:37
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:29:39
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:40
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:41
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:29:42
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:29:43
Start date (UTC):	06/10/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:29:45
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:48
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:59
Start date (UTC):	06/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:30:01
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:30:03
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:30:04
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	20:30:05
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:30:06
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/5636/oom_score_adj

/proc/5639/oom_score_adj

/proc/5641/oom_score_adj

/proc/5643/oom_score_adj

/proc/5645/oom_score_adj

/proc/5647/oom_score_adj

/proc/5650/oom_score_adj

/proc/5727/oom_score_adj

/proc/5755/oom_score_adj

/proc/5758/oom_score_adj

/proc/5762/oom_score_adj

/proc/5764/oom_score_adj

/proc/5766/oom_score_adj

/proc/5768/oom_score_adj

/proc/5771/oom_score_adj

/proc/5949/oom_score_adj

/proc/6109/oom_score_adj

/proc/6127/oom_score_adj

/proc/6357/oom_score_adj

/run/avahi-daemon/pid

/run/gdm3.pid

/run/systemd/inhibit/.#1XdzvZa

/run/systemd/inhibit/.#2qzKwab

/run/systemd/inhibit/.#3EN7mab

/run/systemd/inhibit/.#4vlhGUb

/run/systemd/seats/.#seat07tYIw9

Linux Analysis Report
na.elf

Start time (UTC):	20:30:07
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	20:30:08
Start date (UTC):	06/10/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	20:30:13
Start date (UTC):	06/10/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:30:16
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:30:17
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	/usr/lib/xorg/Xorg vt1 -displayfd 3 -auth /run/user/127/gdm/Xauthority -background none -noreset -keeptty -verbose 3
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:30:29
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:31:02
Start date (UTC):	06/10/2024
Path:	/usr/lib/xorg/Xorg
Arguments:	-
File size:	2448840 bytes
MD5 hash:	730cf4c45a7ee8bea88abf165463b7f8

Start time (UTC):	20:31:03
Start date (UTC):	06/10/2024
Path:	/bin/sh
Arguments:	sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:30:36
Start date (UTC):	06/10/2024
Path:	/usr/lib/gdm3/gdm-x-session
Arguments:	-
File size:	96944 bytes
MD5 hash:	498a824333f1c1ec7767f4612d1887cc

Start time (UTC):	20:30:37
Start date (UTC):	06/10/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4